worklink

maintainer facet · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt x86_64 .deb binary from cos-cdn.cm-worklink.com, which is a CDN associated with the official product domain cm-worklink.com (招商随行, a Chinese enterprise mobile office app by China Merchants Bank). The CDN domain is project-specific but plausibly official. However, the binary is a prebuilt executable installed directly into the system, and there is no way to verify the CDN host's trustworthiness independently. The sha512sum provided for the .deb has an odd length (127 hex chars instead of 128), which may indicate a truncation error and means integrity verification could be broken. The SKIP on the wrapper script is acceptable. The core concern is: prebuilt closed-source binary from a CDN that cannot be independently verified as the canonical upstream release host, combined with a potentially malformed checksum. This is a genuine medium-severity supply-chain concern — not clearly malicious, but the binary execution risk from an unverifiable host is real.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://cos-cdn.cm-worklink.com/hk-gm-cmuop-ceph-steadiness-bucket/${pkgname}_${pkgver}-${_build}-${_commit}_linux-all-amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt x86_64 .deb binary from cos-cdn.cm-worklink.com, which is a CDN associated with the official product domain cm-worklink.com (招商随行, a Chinese enterprise mobile office app by China Merchants Bank). The CDN domain is project-specific but plausibly official. However, the binary is a prebuilt executable installed directly into the system, and there is no way to verify the CDN host's trustworthiness independently. The sha512sum provided for the .deb has an odd length (127 hex chars instead of 128), which may indicate a truncation error and means integrity verification could be broken. The SKIP on the wrapper script is acceptable. The core concern is: prebuilt closed-source binary from a CDN that cannot be independently verified as the canonical upstream release host, combined with a potentially malformed checksum. This is a genuine medium-severity supply-chain concern — not clearly malicious, but the binary execution risk from an unverifiable host is real.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fecet <xiezej@gmail.com>
    
      2pkgname=worklink
    
      3pkgver=4.3.3
    
      4_build=2253
    
      5_commit=55e83b
    
      6pkgrel=2
    
      7pkgdesc="招商随行"
    
      8arch=('x86_64')
    
      9url="https://www.cm-worklink.com"
    
      10license=('custom')
    
      11depends=('desktop-file-utils' 'gtk3' 'hicolor-icon-theme' 'libnotify' 'libsecret' 'libxss' 'libxtst' 'nss' 'util-linux-libs')
    
      12optdepends=('libappindicator-gtk3')
    
      13options=('!strip' '!emptydirs')
    
      14install=${pkgname}.install
    
      15source=("https://cos-cdn.cm-worklink.com/hk-gm-cmuop-ceph-steadiness-bucket/${pkgname}_${pkgver}-${_build}-${_commit}_linux-all-amd64.deb"
    
      16        "${pkgname}.sh")
    
      17sha512sums=('65ff26c1b1d7f332728b92db80a72ea4e172ed06676c37eff62f964ef3975aeeef2a5e5f1ba6f1b4f809c8428250832e8df884d12aa330b862c864fde29e75a0'
    
      18            'SKIP')
    
      19
    
      20package(){
    
      21	# Extract package data
    
      22	tar -xJ -f data.tar.xz -C "${pkgdir}"
    
      23
    
      24	install -D -m644 "${pkgdir}/opt/招商随行/resources/extra_resources/lib/wemeetSDK/Release/raw/ytface_license" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      25
    
      26	# Wrapper that injects IME env vars and forces XWayland for fcitx5 support
    
      27	install -D -m755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      28
    
      29	# Route .desktop launches through the wrapper too
    
      30	sed -i 's|"/opt/招商随行/worklink"|/usr/bin/worklink|' \
    
      31		"${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2