youku

maintainer yetist · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt .deb binary (youku-app_1.0.0_amd64.deb) from mirrors.163.com, which is a NetEase-operated Ubuntu Kylin mirror rather than an official Youku/Alibaba distribution channel. The binary contains an Electron app (app.asar) that gets executed via electron9. While mirrors.163.com is a well-known Chinese mirror site and not a random personal host, the upstream source is an Alibaba-internal GitLab (gitlab.alibaba-inc.com, not publicly accessible), making independent verification of the binary's provenance impossible. The sha256sum provides integrity checking against tampering in transit, but cannot verify that the binary at that URL is the legitimate upstream release. The executed asar bundle could contain arbitrary Node.js code. This is a genuine supply-chain concern: a prebuilt executable from a non-primary host for software whose canonical source is inaccessible, though not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=('youku.deb::https://mirrors.163.com/ubuntukylin/pool/partner/youku-app_1.0.0_amd64.deb'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt .deb binary (youku-app_1.0.0_amd64.deb) from mirrors.163.com, which is a NetEase-operated Ubuntu Kylin mirror rather than an official Youku/Alibaba distribution channel. The binary contains an Electron app (app.asar) that gets executed via electron9. While mirrors.163.com is a well-known Chinese mirror site and not a random personal host, the upstream source is an Alibaba-internal GitLab (gitlab.alibaba-inc.com, not publicly accessible), making independent verification of the binary's provenance impossible. The sha256sum provides integrity checking against tampering in transit, but cannot verify that the binary at that URL is the legitimate upstream release. The executed asar bundle could contain arbitrary Node.js code. This is a genuine supply-chain concern: a prebuilt executable from a non-primary host for software whose canonical source is inaccessible, though not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Xiaotian Wu <yetist@gmail.com>
    
      2
    
      3pkgname=youku
    
      4pkgver=1.0.0
    
      5pkgrel=5
    
      6pkgdesc="YouKu Video client"
    
      7url="http://gitlab.alibaba-inc.com/youku-node/uos-youku-app/blob/master/README.md"
    
      8arch=('x86_64')
    
      9license=('custom')
    
      10depends=('electron9')
    
      11source=('youku.deb::https://mirrors.163.com/ubuntukylin/pool/partner/youku-app_1.0.0_amd64.deb'
    
      12        'youku.desktop'
    
      13	'electron.sh'
    
      14	'youku.sh'
    
      15)
    
      16sha256sums=('c28ade22d41fa6074fce7f2cb06f9db4dfba439698bbea37b0f5735d9ae30075'
    
      17            '6b984c5b95804defaaa8bba57563e7dbe0a6a841712240822a1764670cd805c2'
    
      18            '9e5af9a8e359e8b8cc3d0fb2eb4c0309fc7ace80174ca9cc93f8c5c3ef408773'
    
      19            'c2e1562b03b6d91932a71fa7e52c3263e8e4e53b961326c3fe71bf8ac4f6ac87')
    
      20noextract=('youku.deb')
    
      21
    
      22build() {
    
      23  ar x youku.deb
    
      24  tar xf data.tar.xz #resources
    
      25}
    
      26
    
      27package() {
    
      28
    
      29  # App resources
    
      30  install -Dm644 opt/优酷/resources/app.asar ${pkgdir}/usr/lib/${pkgname}/resources/${pkgname}.asar
    
      31  cp -r opt/优酷/resources/assets ${pkgdir}/usr/lib/${pkgname}/
    
      32  install -Dm755 ${srcdir}/electron.sh ${pkgdir}/usr/lib/${pkgname}/electron
    
      33
    
      34  # binary command
    
      35  install -Dm755 youku.sh ${pkgdir}/usr/bin/${pkgname}
    
      36
    
      37  # Install desktop file
    
      38  install -Dm644 ${srcdir}/youku.desktop -t ${pkgdir}/usr/share/applications/
    
      39
    
      40  # copy app.asar and other resource files
    
      41  cd $srcdir/usr/share/icons
    
      42  find . -type d -exec install -d {,"$pkgdir"/usr/share/icons/}{} \;
    
      43  for i in `find . -type f`;do
    
      44    install -Dm644 $i "$pkgdir"/usr/share/icons/`echo $i | tr 'A-Z' 'a-z'`
    
      45  done
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2