yandex-messenger

MEDIUM

maintainer bulatovv 0 votes scanned 2026-11-01 18:01:05.785766

View on AUR

Why flagged

The package downloads a prebuilt Debian binary from a Yandex Disk URL, which is an unverifiable and potentially swappable host; if compromised, the binary could execute arbitrary code during installation or runtime.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/4ebed5e3d7e47dc7478fcea99a3b0f91e668a5f4b3dc39ab43e14d289c0f3008/6ae78c32/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Debian binary from a Yandex Disk URL, which is an unverifiable and potentially swappable host; if compromised, the binary could execute arbitrary code during installation or runtime.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Albert Fazlyev <albert.fz@yandex.ru>
    
      2pkgname=yandex-messenger
    
      3pkgver=2.155.0
    
      4pkgrel=4
    
      5pkgdesc="Yandex Messenger is designed for communication: send text messages, make audio and video calls in private and group chats, subscribe to and create channels. Communicate with colleagues in a private space."
    
      6arch=('x86_64')
    
      7url="https://yandex.com/support/messenger/install.html"
    
      8license=('custom')
    
      9
    
      10source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/4ebed5e3d7e47dc7478fcea99a3b0f91e668a5f4b3dc39ab43e14d289c0f3008/6ae78c32/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1")
    
      11noextract=("${pkgname}_${pkgver}_amd64.deb")
    
      12
    
      13depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'util-linux-libs' 'libappindicator-gtk3' 'libsecret')
    
      14b2sums=('b22f77140bf2ee7e7c70a6ab9e96d45a3b8f568386ddcadb7e57c4e5bd6f57e9cf77276cf737b016aade1148e60af51aaad4ebf153551f725242caa0713528c1')
    
      15
    
      16
    
      17package() {
    
      18  bsdtar -O -xf "${pkgname}_${pkgver}_amd64.deb" data.tar.xz | bsdtar -C "${pkgdir}" -xJf -
    
      19
    
      20  install -d "${pkgdir}/usr/bin"
    
      21  ln -s '/opt/Yandex Messenger/chats' "${pkgdir}/usr/bin/yandex-messenger"
    
      22}
    
      23
    
      24

Changes since previous scan

--- PKGBUILD @ 2026-11-01 14:00
+++ PKGBUILD @ 2026-11-01 18:01
@@ -7,7 +7,7 @@
 url="https://yandex.com/support/messenger/install.html"
 license=('custom')
 
-source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/b23088da053861a569978672768465c99a3353a953ceb2f67547c9c2e882da88/6ae753f1/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1")
+source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/4ebed5e3d7e47dc7478fcea99a3b0f91e668a5f4b3dc39ab43e14d289c0f3008/6ae78c32/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1")
 noextract=("${pkgname}_${pkgver}_amd64.deb")
 
 depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'util-linux-libs' 'libappindicator-gtk3' 'libsecret')

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 18:01:05	Medium	2
2026-11-01 16:01:05	Medium	2
2026-11-01 14:00:44	Medium	2
2026-11-01 12:00:25	Medium	1
2026-11-01 10:00:05	Medium	1
2026-11-01 07:59:34	Medium	2
2026-11-01 05:59:34	Medium	2
2026-11-01 03:59:29	Medium	2
2026-11-01 01:59:19	Medium	2
2026-11-01 00:21:48	Medium	2
2026-10-31 23:59:16	Medium	2
2026-10-31 21:59:05	Medium	2
2026-10-31 19:58:49	Medium	2
2026-10-31 17:58:44	Medium	2
2026-10-31 15:58:34	Medium	1
2026-10-31 13:58:24	Medium	1
2026-10-31 11:58:11	Medium	2
2026-10-31 09:58:05	Medium	2
2026-10-31 07:58:04	Medium	2
2026-10-31 05:57:59	Medium	1