wyc

maintainer taotieren · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binaries directly from api.wangyunchuan.com (the vendor's own API endpoint) and installs them as executables in /usr/bin. While this is the official vendor host for the 网云穿 (WangYunChuan) port-mapping service, the binaries are fetched from a dynamic API endpoint rather than a versioned release artifact, meaning the content could change without a corresponding checksum update. However, sha256sums ARE present and pinned for both architecture-specific binaries, which mitigates the dynamic-URL concern to some degree. The core risk is that these are closed-source, prebuilt binaries from a single vendor-controlled host with no independent verification path (no GitHub releases, no reproducible build). If the vendor's API is compromised or the vendor acts maliciously, arbitrary code runs with user privileges (and as a systemd service, potentially persistently). This is a genuine supply-chain concern — executed foreign binary from a non-auditable source — but not an active attack, placing it squarely at medium severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "${pkgname}-x86_64-${pkgver}::https://api.wangyunchuan.com/app/cms/linux/app_download?cpuArch=x86&osBit=64&type=app"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads prebuilt binaries directly from api.wangyunchuan.com (the vendor's own API endpoint) and installs them as executables in /usr/bin. While this is the official vendor host for the 网云穿 (WangYunChuan) port-mapping service, the binaries are fetched from a dynamic API endpoint rather than a versioned release artifact, meaning the content could change without a corresponding checksum update. However, sha256sums ARE present and pinned for both architecture-specific binaries, which mitigates the dynamic-URL concern to some degree. The core risk is that these are closed-source, prebuilt binaries from a single vendor-controlled host with no independent verification path (no GitHub releases, no reproducible build). If the vendor's API is compromised or the vendor acts maliciously, arbitrary code runs with user privileges (and as a systemd service, potentially persistently). This is a genuine supply-chain concern — executed foreign binary from a non-auditable source — but not an active attack, placing it squarely at medium severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2
    
      3pkgbase=wyc
    
      4pkgname=wyc
    
      5pkgver=7
    
      6pkgrel=20
    
      7pkgdesc="网云穿最便捷的端口映射"
    
      8license=('LicenseRef-scancode-commercial-license')
    
      9url="https://wangyunchuan.com"
    
      10arch=($CARCH)
    
      11options=(!strip !debug)
    
      12depends=(
    
      13    sh
    
      14)
    
      15makedepends=(libarchive)
    
      16provides=(${pkgname} ${pkgname}-bin)
    
      17conflicts=(${pkgname} ${pkgname}-bin)
    
      18replaces=()
    
      19# backup=(etc/wangyunchuan/)
    
      20install=${pkgname}.install
    
      21source=(
    
      22    "wangyunchuan@.service"
    
      23    "wangyunchuan-watchdog@.service"
    
      24    "wangyunchuan-watchdog@.timer"
    
      25    "wycctl"
    
      26    "wangyunchuan.tmpfiles"
    
      27    "wangyunchuan.sysusers"
    
      28    "${pkgname}.install"
    
      29    #     "LICENSE::https://wangyunchuan.com/agreement"
    
      30    "LICENSE.txt"
    
      31    "${pkgname}-x86_64-${pkgver}::https://api.wangyunchuan.com/app/cms/linux/app_download?cpuArch=x86&osBit=64&type=app"
    
      32    "${pkgname}-aarch64-${pkgver}::https://api.wangyunchuan.com/app/cms/arm/app_download?cpuArch=ARM&osBit=64&type=app"
    
      33)
    
      34sha256sums=('32a0b3c2b9f8b44e9a43db0708babb01862dea4dd20f2998478a7de19731ec6e'
    
      35            '92a7e0ef4b7f6da103fdd4cd40d316ff9cb5bddf27907ce59968559fe1beb0dd'
    
      36            'da64bca6d4c15fd0bced35db4468ddfefb31163f631c3efb827c8b4e6bcf4bd4'
    
      37            '1b0e0651a2fe6e50c55ad66af8ca106530d7695fa2d518d0b6ebbbd2cdb18536'
    
      38            '34990ee4d0f935b0f97f2107fa65a63b9aad8f01fc6aac8f927b8cb4bb56981b'
    
      39            '1f64b0ebd17ccbf69024e62622816474800f07049a5a5bc85ede142a0ea77523'
    
      40            'b3831c456d2dc2aa4a8b2dce9f69fc3772a81ba42bd9d84947a159bf0f83ea7b'
    
      41            '3f3715937f9e3ae47d4deac0faef7b9072df4048083410454c6dc561688e5824'
    
      42            '00529da711eb6b2cc1a1c25dcbcae6307088059aad427383bd38d138f13029ab'
    
      43            'a53ad0268f50ed19f996de00d40977b3bd9c070cefeb8d23568ea16b61d43309')
    
      44noextract=()
    
      45
    
      46package() {
    
      47    if [ "$CARCH" == "aarch64" ]; then
    
      48        msg2 "Install for arm64"
    
      49        install -vDm755 ${srcdir}/${pkgname}-${CARCH}-${pkgver} ${pkgdir}/usr/bin/${pkgname}
    
      50    elif [ "$CARCH" == "x86_64" ]; then
    
      51        msg2 "Install for x64"
    
      52        install -vDm755 ${srcdir}/${pkgname}-${CARCH}-${pkgver} ${pkgdir}/usr/bin/${pkgname}
    
      53    else
    
      54        msg2 "Unsupported architectures"
    
      55    fi
    
      56
    
      57    install -vDm755 ${srcdir}/wycctl -t ${pkgdir}/usr/bin/
    
      58    install -vDm644 ${srcdir}/wangyunchuan@.service -t ${pkgdir}/usr/lib/systemd/system/
    
      59    install -vDm644 ${srcdir}/wangyunchuan-watchdog@.service -t ${pkgdir}/usr/lib/systemd/system/
    
      60    install -vDm644 ${srcdir}/wangyunchuan-watchdog@.timer -t ${pkgdir}/usr/lib/systemd/system/
    
      61    install -vdm755 ${pkgdir}/etc/wangyunchuan \
    
      62        ${pkgdir}/var/log/wangyunchuan
    
      63    install -Dvm644 "${srcdir}/wangyunchuan.sysusers" "${pkgdir}/usr/lib/sysusers.d/wangyunchuan.conf"
    
      64    install -Dvm644 "${srcdir}/wangyunchuan.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/wangyunchuan.conf"
    
      65    install -vDm644 ${srcdir}/LICENSE.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2