yandex-messenger
maintainer bulatovv
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt Debian package from a Yandex disk URL, which is an unverifiable and potentially swappable host; while Yandex is a known entity, the use of a direct download link with a complex, non-standard URL pattern and a skipped checksum verification (b2sums present but not checked due to complexity) creates a supply-chain risk if the source were silently replaced.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:10
source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/b8665ce3d94ab63d97acab354faf2d862e38bc5af1f287694ace3a3f31b3bef3/6a6dedd1/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1")
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Debian package from a Yandex disk URL, which is an unverifiable and potentially swappable host; while Yandex is a known entity, the use of a direct download link with a complex, non-standard URL pattern and a skipped checksum verification (b2sums present but not checked due to complexity) creates a supply-chain risk if the source were silently replaced.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Albert Fazlyev <albert.fz@yandex.ru>
2
pkgname=yandex-messenger
3
pkgver=2.155.0
4
pkgrel=4
5
pkgdesc="Yandex Messenger is designed for communication: send text messages, make audio and video calls in private and group chats, subscribe to and create channels. Communicate with colleagues in a private space."
6
arch=('x86_64')
7
url="https://yandex.com/support/messenger/install.html"
8
license=('custom')
9
10
source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/b8665ce3d94ab63d97acab354faf2d862e38bc5af1f287694ace3a3f31b3bef3/6a6dedd1/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1")
11
noextract=("${pkgname}_${pkgver}_amd64.deb")
12
13
depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'util-linux-libs' 'libappindicator-gtk3' 'libsecret')
14
b2sums=('b22f77140bf2ee7e7c70a6ab9e96d45a3b8f568386ddcadb7e57c4e5bd6f57e9cf77276cf737b016aade1148e60af51aaad4ebf153551f725242caa0713528c1')
15
16
17
package() {
18
bsdtar -O -xf "${pkgname}_${pkgver}_amd64.deb" data.tar.xz | bsdtar -C "${pkgdir}" -xJf -
19
20
install -d "${pkgdir}/usr/bin"
21
ln -s '/opt/Yandex Messenger/chats' "${pkgdir}/usr/bin/yandex-messenger"
22
}
23
24
Changes since previous scan
--- PKGBUILD @ 2026-08-01 09:20+++ PKGBUILD @ 2026-08-03 00:08@@ -7,7 +7,7 @@ url="https://yandex.com/support/messenger/install.html" license=('custom') -source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/e040bd455687a27677b0d7a0caf6520e7358f651125c374675d7e0cb0914538b/6a6dd1b1/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1")+source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/b8665ce3d94ab63d97acab354faf2d862e38bc5af1f287694ace3a3f31b3bef3/6a6dedd1/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1") noextract=("${pkgname}_${pkgver}_amd64.deb") depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'util-linux-libs' 'libappindicator-gtk3' 'libsecret')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 11:20:22 | MEDIUM | 2 |
| 2026-08-01 09:20:18 | MEDIUM | 2 |
| 2026-08-01 07:20:18 | MEDIUM | 2 |
| 2026-08-01 05:20:08 | MEDIUM | 2 |
| 2026-08-01 03:19:42 | MEDIUM | 2 |
| 2026-08-01 01:19:40 | MEDIUM | 1 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 23:19:22 | MEDIUM | 2 |
| 2026-07-31 21:18:45 | MEDIUM | 2 |
| 2026-07-31 19:18:43 | MEDIUM | 2 |
| 2026-07-31 17:18:23 | MEDIUM | 2 |
| 2026-07-31 15:18:17 | MEDIUM | 2 |
| 2026-07-31 13:18:10 | MEDIUM | 2 |
| 2026-07-31 11:17:50 | MEDIUM | 2 |
| 2026-07-31 09:17:30 | MEDIUM | 2 |
| 2026-07-31 07:17:22 | MEDIUM | 2 |
| 2026-07-31 05:17:13 | MEDIUM | 2 |
| 2026-07-31 03:17:12 | MEDIUM | 2 |