yandex-messenger
LOW
maintainer bulatovv
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt .deb from Yandex's official domain (disk.yandex.ru) to extract and install Yandex Messenger; while the host is not a standard code forge, it is the official vendor, making the source trustworthy despite the non-whitelisted URL.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Yandex's official domain (disk.yandex.ru) to extract and install Yandex Messenger; while the host is not a standard code forge, it is the official vendor, making the source trustworthy despite the non-whitelisted URL.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:10
source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/690d793f15c50ca426bc3b74daa7cb3322fbdecf52519afd62047387aa1a2b21/6aab1f71/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Albert Fazlyev <albert.fz@yandex.ru>
2
pkgname=yandex-messenger
3
pkgver=2.155.0
4
pkgrel=4
5
pkgdesc="Yandex Messenger is designed for communication: send text messages, make audio and video calls in private and group chats, subscribe to and create channels. Communicate with colleagues in a private space."
6
arch=('x86_64')
7
url="https://yandex.com/support/messenger/install.html"
8
license=('custom')
9
10
source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/690d793f15c50ca426bc3b74daa7cb3322fbdecf52519afd62047387aa1a2b21/6aab1f71/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1")
11
noextract=("${pkgname}_${pkgver}_amd64.deb")
12
13
depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'util-linux-libs' 'libappindicator-gtk3' 'libsecret')
14
b2sums=('b22f77140bf2ee7e7c70a6ab9e96d45a3b8f568386ddcadb7e57c4e5bd6f57e9cf77276cf737b016aade1148e60af51aaad4ebf153551f725242caa0713528c1')
15
16
17
package() {
18
bsdtar -O -xf "${pkgname}_${pkgver}_amd64.deb" data.tar.xz | bsdtar -C "${pkgdir}" -xJf -
19
20
install -d "${pkgdir}/usr/bin"
21
ln -s '/opt/Yandex Messenger/chats' "${pkgdir}/usr/bin/yandex-messenger"
22
}
23
24
Changes since previous scan
--- PKGBUILD @ 2026-09-16 19:23+++ PKGBUILD @ 2026-09-17 00:27@@ -7,7 +7,7 @@ url="https://yandex.com/support/messenger/install.html" license=('custom') -source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/25f52716768bae4585cda9ddc379bb8aac65a7811e42afdf8bf5d4e2692d918a/6aab0351/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1")+source=("${pkgname}_${pkgver}_amd64.deb::https://downloader.disk.yandex.ru/disk/690d793f15c50ca426bc3b74daa7cb3322fbdecf52519afd62047387aa1a2b21/6aab1f71/fKqInKw3d7bLFOeFnMGnhNWxCpe349obSYmly8cW7zZJ_fniSbaCrlwjQTbvB92IUPUnXitKQ2ltyzIVVtHF0RfdGUpZH039231ae3iQvySr8npumZHI4midPdWhecNq?uid=0&filename=Yandex_Messenger_2.155.0_amd64.deb&disposition=attachment&hash=7bGpeID6q904ZsjE4/ehCmxnCtN1OkUIf5Iszu%2B0hU8Gu1h8chTxFpPyI2je%2BlPrlsg4VIaLrfRKbQetv4dueQ%3D%3D%3A&limit=0&content_type=application%2Fvnd.debian.binary-package&owner_uid=1130000063429726&fsize=73548980&hid=d833151ad80ffb273b072a7a34c673d9&media_type=compressed&tknv=v3&is_direct_zip_experiment=1") noextract=("${pkgname}_${pkgver}_amd64.deb") depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'util-linux-libs' 'libappindicator-gtk3' 'libsecret')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 21:23:45 | Medium | 1 |
| 2026-09-16 19:23:36 | Medium | 1 |
| 2026-09-16 17:23:26 | Medium | 1 |
| 2026-09-16 15:22:50 | Medium | 2 |
| 2026-09-16 13:22:46 | Medium | 2 |
| 2026-09-16 11:22:36 | Medium | 2 |
| 2026-09-16 09:21:46 | Medium | 1 |
| 2026-09-16 07:21:35 | Medium | 2 |
| 2026-09-16 05:21:26 | Medium | 2 |
| 2026-09-16 03:21:15 | Medium | 2 |
| 2026-09-16 01:20:46 | Medium | 1 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 23:20:44 | Medium | 2 |
| 2026-09-15 21:20:38 | Medium | 2 |
| 2026-09-15 19:20:17 | Medium | 2 |
| 2026-09-15 17:20:16 | Medium | 2 |
| 2026-09-15 15:19:57 | Medium | 2 |
| 2026-09-15 13:19:52 | Medium | 2 |
| 2026-09-15 11:19:45 | Medium | 2 |