yunhu

maintainer Tuneful · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt proprietary binary tarball from app-cdn1.jwznb.com, which is not the official yhchat.com domain. The domain jwznb.com appears to be a CDN used by the Yunhu/YHChat application (yunhu is the app name, yhchat.com is the official site), so this may be a legitimate vendor CDN rather than a random third-party host. However, it cannot be independently verified as an official distribution channel from the project's primary domain. A prebuilt executable is extracted and installed to /opt and /usr/bin, meaning any compromise of this CDN host would result in arbitrary code execution on the user's system. The sha256sum provides integrity checking against tampering in transit, but does not protect against the upstream host serving a malicious binary from the start. This is a genuine medium-severity supply-chain concern: an executed binary from a host that cannot be confirmed as the official vendor distribution point.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://app-cdn1.jwznb.com/linux/yunhu-1.6.13+188-linux.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt proprietary binary tarball from app-cdn1.jwznb.com, which is not the official yhchat.com domain. The domain jwznb.com appears to be a CDN used by the Yunhu/YHChat application (yunhu is the app name, yhchat.com is the official site), so this may be a legitimate vendor CDN rather than a random third-party host. However, it cannot be independently verified as an official distribution channel from the project's primary domain. A prebuilt executable is extracted and installed to /opt and /usr/bin, meaning any compromise of this CDN host would result in arbitrary code execution on the user's system. The sha256sum provides integrity checking against tampering in transit, but does not protect against the upstream host serving a malicious binary from the start. This is a genuine medium-severity supply-chain concern: an executed binary from a host that cannot be confirmed as the official vendor distribution point.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tuneful <tuneful "dot" su "at" yandex "dot" com>
    
      2
    
      3pkgname=yunhu
    
      4pkgver=1.6.13+188
    
      5pkgrel="1"
    
      6pkgdesc="yunhu-1.6.13+188 for Linux (Commercial software, please refer to the license terms.)"
    
      7arch=('x86_64')
    
      8url="https://www.yhchat.com/"
    
      9license=('proprietary')
    
      10depends=(
    
      11	libayatana-appindicator
    
      12	mpv
    
      13	jq
    
      14)
    
      15source=("https://app-cdn1.jwznb.com/linux/yunhu-1.6.13+188-linux.tar.gz")
    
      16sha256sums=('881bf287e0f8ccc40e8c5ca967d4c433706a3032fc834e66fc350750ec0348a7')
    
      17
    
      18package() {
    
      19	export LD_PRELOAD=/usr/lib/libfakeroot/libfakeroot.so
    
      20	cd "$srcdir"
    
      21	mkdir -p "$pkgdir/opt/"
    
      22	tar -xzvf "yunhu-1.6.13+188-linux.tar.gz" -C "$pkgdir/opt/"
    
      23	mv "$pkgdir/opt/yunhu-1.6.13+188-linux/yunhu" "$pkgdir/opt/"
    
      24	install -Dm644 "$srcdir/yunhu-1.6.13+188-linux/applications/yunhu.desktop" "$pkgdir/usr/share/applications/yunhu.desktop"
    
      25	for size in 16x16 32x32 48x48 64x64 128x128 256x256
    
      26	do
    
      27		install -Dm644 "$srcdir/yunhu-1.6.13+188-linux/icons/hicolor/$size/apps/yunhu.png" "$pkgdir/usr/share/icons/hicolor/$size/apps/yunhu.png"
    
      28	done
    
      29
    
      30
    
      31	# 确保目标路径存在
    
      32	install -d "$pkgdir/usr/lib"
    
      33	install -d "$pkgdir/usr/bin"
    
      34
    
      35	# 检查系统中是否存在 /usr/lib/libmpv.so.1
    
      36	if [ ! -e /usr/lib/libmpv.so.1 ]; then
    
      37		# 创建符号链接
    
      38		ln -s /usr/lib/libmpv.so.2 "$pkgdir/usr/lib/libmpv.so.1"
    
      39	fi
    
      40
    
      41	ln -s /opt/yunhu/yunhu "$pkgdir/usr/bin"
    
      42
    
      43	# 删除不需要的目录
    
      44	rm -rf "$pkgdir/opt/yunhu-1.6.13+188-linux/"
    
      45}
    
      46
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2