zerx-lab-dida-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:18 source_x86_64=("dida-${pkgver}-amd64.deb::https://dida365.com/static/getApp/download?type=linux_deb_x64")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt Electron binary (.deb) directly from dida365.com (the official vendor domain for the TickTick/Dida365 app) and installs it. The domain is the legitimate upstream vendor, not a personal or unofficial host, which reduces supply-chain risk compared to a random GitHub user's server. However, the source URL is a dynamic download endpoint ('?type=linux_deb_x64') rather than a versioned, stable artifact URL, meaning the sha256sum provides integrity verification only at packaging time — if the endpoint silently serves a different binary later, the checksum would catch it. The binary is a closed-source Electron app installed to /opt/dida with chrome-sandbox set SUID 4755, which is standard for Electron apps but does represent elevated privilege. The sha256sum is present and pinned, which is the primary mitigation. Overall this is a legitimate proprietary binary package from the official vendor with a pinned checksum, which is a common and accepted AUR pattern (similar to google-chrome, zoom, etc.). The medium rating from the cheaper model is a mild false positive — this is standard practice for proprietary binary AUR packages from official vendor domains with checksums present.