xtool-creative-space

maintainer baltazar · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows .exe installer from storage-us.xtool.com (xTool's official CDN/storage host for their laser software), extracts it with asar, and installs the resulting Electron app. The host appears to be xTool's own distribution infrastructure (consistent with the official product URL xtool.com/pages/software), not a personal or third-party host. However, the source is a prebuilt binary blob from a CDN path with a UUID-style directory, there is no GPG signature verification, and the sha256 checksums are the only integrity guarantee. The package also substitutes a sharp native module and copies it over a proprietary xcs_cpp_module binary (acknowledged as a hack). Executing extracted native .node binaries from a proprietary vendor package without signature verification is a genuine supply-chain concern — if the CDN or the UUID path were compromised, arbitrary native code would execute. This is a real medium-severity concern: prebuilt executed binaries from a vendor CDN without cryptographic signing, though not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "https://storage-us.xtool.com/resource/efficacy/xcs/prod-us/packages/15/acc9990c-d436-483c-89bf-d9749831be1f/$_fname"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows .exe installer from storage-us.xtool.com (xTool's official CDN/storage host for their laser software), extracts it with asar, and installs the resulting Electron app. The host appears to be xTool's own distribution infrastructure (consistent with the official product URL xtool.com/pages/software), not a personal or third-party host. However, the source is a prebuilt binary blob from a CDN path with a UUID-style directory, there is no GPG signature verification, and the sha256 checksums are the only integrity guarantee. The package also substitutes a sharp native module and copies it over a proprietary xcs_cpp_module binary (acknowledged as a hack). Executing extracted native .node binaries from a proprietary vendor package without signature verification is a genuine supply-chain concern — if the CDN or the UUID path were compromised, arbitrary native code would execute. This is a real medium-severity concern: prebuilt executed binaries from a vendor CDN without cryptographic signing, though not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Baltazár Radics <baltazar.radics@gmail.com>
    
      2pkgname=xtool-creative-space
    
      3_date=2025-06-19-11-01-27
    
      4_sharpver=0.32.6
    
      5pkgver=2.7.22
    
      6pkgrel=1
    
      7pkgdesc='The Strongest Yet Easiest Laser Software'
    
      8arch=(x86_64)
    
      9url='https://www.xtool.com/pages/software'
    
      10license=(proprietary)
    
      11_electron=electron31
    
      12depends=($_electron libvips bubblewrap)
    
      13makedepends=(asar)
    
      14options=(!debug)
    
      15_fname="xTool-Creative-Space-$pkgver-$_date.exe"
    
      16# curl -s https://www.xtool.com/pages/software | grep -o 'data-href="[^"]*.exe"'
    
      17source=(
    
      18	"https://storage-us.xtool.com/resource/efficacy/xcs/prod-us/packages/15/acc9990c-d436-483c-89bf-d9749831be1f/$_fname"
    
      19	"https://github.com/lovell/sharp/releases/download/v$_sharpver/sharp-v$_sharpver-napi-v7-linux-x64.tar.gz"
    
      20	$pkgname.{sh,desktop}
    
      21)
    
      22sha256sums=('6cd17873b10b62d1d00001c724251e5f58123964b2ec5060ad389ca72389ac9a'
    
      23            '994679b5089fee0608f94f1b5f6f75a0dcc79a64f3a929d147503e8d0e91dd2f'
    
      24            '8a7e431c37b526eafcf825eaeabac17d7232c03e8077bb5e345bd147a49d6f9d'
    
      25            '619023f7b9f981df633985134d50195bab3b93a7ae2a53921df6ceb9ff022299')
    
      26
    
      27build() {
    
      28	asar e resources/app.asar app
    
      29	rm -rf app/node_modules/sharp/{build,vendor}
    
      30	cp -Ta build app/node_modules/sharp/build
    
      31	rm -rf buildResources/esptool
    
      32	# Absolute hack. New version tries to load this on startup so it fails to start at all.
    
      33	# This way, it won't crash immediately but it's still unable to actually plot stuff.
    
      34	cp build/Release/sharp-linux-x64.node app/node_modules/@xtool/xcs_cpp_module/prebuild/electron/31.7/xcs_cpp_module.node
    
      35}
    
      36
    
      37package() {
    
      38	install -d "$pkgdir"/usr/lib/$pkgname/resources
    
      39	cp -Ta buildResources "$pkgdir"/usr/lib/$pkgname/buildResources
    
      40	asar p app "$pkgdir"/usr/lib/$pkgname/resources/app.asar --unpack-dir 'node_modules/{@makeblock,sharp,@xtool}'
    
      41	install -Dm755 $pkgname.sh "$pkgdir"/usr/bin/$pkgname
    
      42	install -Dm644 $pkgname.desktop "$pkgdir"/usr/share/applications/$pkgname.desktop
    
      43	install -Dm644 "$pkgdir"/usr/lib/$pkgname/buildResources/linux/256x256.png "$pkgdir"/usr/share/pixmaps/$pkgname.png
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2