zalo-macos

maintainer nanoka · 6 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt macOS DMG (a universal binary) from zadn.vn (Zalo's CDN, which is the official Vietnamese messaging app's infrastructure) and extracts an Electron app.asar plus unpacked native modules from it, then runs them under electron22-bin on Linux. The concerns are: (1) The source is a prebuilt binary blob (app.asar + app.asar.unpacked with native code) executed at runtime via Electron — not compiled from source — so any compromise of the CDN or a silent swap would deliver arbitrary code to users. (2) The sha256sum for the DMG is provided and pinned, which mitigates silent substitution somewhat, but the LICENSE.html is fetched with SKIP, meaning that fetch is unverified. (3) zadn.vn is Zalo's legitimate CDN domain, so this is not a random personal host, but it is still a binary-blob supply chain. (4) The package is described as 'unofficial' — it is a community repackaging of a proprietary macOS binary for Linux, which is a grey area but not clearly piracy since it is not cracking DRM. Overall this is a genuine medium: executed proprietary binary from a vendor CDN, not compiled from source, with the inherent supply-chain risk that entails.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 "zalo.dmg::https://res-download-pc-te-vnso-ne-2.zadn.vn/mac/ZaloSetup-universal-${pkgver}.dmg"
PKGBUILD:25 "LICENSE.html::https://zalo.vn/dieukhoan"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt macOS DMG (a universal binary) from zadn.vn (Zalo's CDN, which is the official Vietnamese messaging app's infrastructure) and extracts an Electron app.asar plus unpacked native modules from it, then runs them under electron22-bin on Linux. The concerns are: (1) The source is a prebuilt binary blob (app.asar + app.asar.unpacked with native code) executed at runtime via Electron — not compiled from source — so any compromise of the CDN or a silent swap would deliver arbitrary code to users. (2) The sha256sum for the DMG is provided and pinned, which mitigates silent substitution somewhat, but the LICENSE.html is fetched with SKIP, meaning that fetch is unverified. (3) zadn.vn is Zalo's legitimate CDN domain, so this is not a random personal host, but it is still a binary-blob supply chain. (4) The package is described as 'unofficial' — it is a community repackaging of a proprietary macOS binary for Linux, which is a grey area but not clearly piracy since it is not cracking DRM. Overall this is a genuine medium: executed proprietary binary from a vendor CDN, not compiled from source, with the inherent supply-chain risk that entails.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Nguyen Hoang Ky <nhktmdzhg at gmail dot com>
    
      2_pkgname=zalo
    
      3pkgname=zalo-macos
    
      4provides=(zalo)
    
      5pkgver=26.4.10
    
      6pkgrel=1
    
      7epoch=1
    
      8pkgdesc="Unofficial Zalo client for Linux, ported from MacOS version"
    
      9arch=('x86_64')
    
      10url="https://zalo.me"
    
      11license=('custom')
    
      12depends=(
    
      13    'python-pillow'
    
      14    'python-pystray'
    
      15    'electron22-bin'
    
      16)
    
      17makedepends=(
    
      18    '7zip'
    
      19)
    
      20source=(
    
      21    "zalo.dmg::https://res-download-pc-te-vnso-ne-2.zadn.vn/mac/ZaloSetup-universal-${pkgver}.dmg"
    
      22    "zalo.desktop"
    
      23    "zalo_py"
    
      24    "Zalo.png"
    
      25    "LICENSE.html::https://zalo.vn/dieukhoan"
    
      26)
    
      27noextract=("zalo.dmg")
    
      28sha256sums=(
    
      29    '411768e783cdaea627baac7b591d19d511db5ff211fdef199ac92c9b97f62049'
    
      30    '3c54d9828c0e4b763226516ab1d7984c72777e70165983795f5d77c8db93fec9'
    
      31    '1d193ab57424a663d0f1180219a7dd8454ba325fdcc75fa0eb4b343e733e32a0'
    
      32    '54556414e921d2e72db65cdace024251c05e31ce2e1aa3db82aa330436815445'
    
      33    'SKIP'
    
      34)
    
      35options=('!strip' '!purge')
    
      36prepare() {
    
      37    local archive_path="Zalo ${pkgver}-universal/Zalo.app/Contents/Resources"
    
      38    mkdir -p "${srcdir}/build"
    
      39    for file in app-update.yml app.asar icon.icns app.asar.unpacked; do
    
      40        7z x -y "${srcdir}/zalo.dmg" "$archive_path/$file"
    
      41        mv "$archive_path/$file" "${srcdir}/build/"
    
      42    done
    
      43    rm -rf "Zalo ${pkgver}-universal"
    
      44}
    
      45
    
      46package() {
    
      47    install -d "${pkgdir}/opt/${_pkgname}"
    
      48    install -m644 "${srcdir}/build/app.asar" "${pkgdir}/opt/${_pkgname}/app.asar"
    
      49    install -m644 "${srcdir}/build/icon.icns" "${pkgdir}/opt/${_pkgname}/icon.icns"
    
      50    cp -r "${srcdir}/build/app.asar.unpacked" "${pkgdir}/opt/${_pkgname}/app.asar.unpacked"
    
      51    install -m644 "${srcdir}/Zalo.png" "${pkgdir}/opt/${_pkgname}/icon.png"
    
      52    install -Dm644 "${srcdir}/zalo.desktop" "${pkgdir}/usr/share/applications/zalo.desktop"
    
      53    install -Dm755 "${srcdir}/zalo_py" "${pkgdir}/usr/bin/zalo"
    
      54    install -Dm644 "${srcdir}/LICENSE.html" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE.html"
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2