zvvonlinemusic

maintainer Agafron · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt binary .deb is downloaded from Dropbox (a personal/unofficial host with no content-addressable guarantee beyond a weak MD5 checksum), extracted, and installed directly into the system. The Dropbox URL can be silently redirected or the file replaced by the account owner at any time without changing the URL. MD5 is cryptographically broken and provides no meaningful integrity guarantee against a determined attacker. The extracted binary and its data files are executed/installed as system software (python app + VLC plugin likely), making this a genuine supply-chain risk: if the Dropbox-hosted .deb were tampered with, arbitrary code would run on the user's system. This is a textbook medium-severity AUR concern — not clearly malicious, but an executed binary from an unofficial, mutable, personally-controlled host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("${pkgname}_${pkgver}.deb::https://www.dropbox.com/s/2af2ls7jmug9ca2/zvvonlinemusic_06.deb?dl=0"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): A prebuilt binary .deb is downloaded from Dropbox (a personal/unofficial host with no content-addressable guarantee beyond a weak MD5 checksum), extracted, and installed directly into the system. The Dropbox URL can be silently redirected or the file replaced by the account owner at any time without changing the URL. MD5 is cryptographically broken and provides no meaningful integrity guarantee against a determined attacker. The extracted binary and its data files are executed/installed as system software (python app + VLC plugin likely), making this a genuine supply-chain risk: if the Dropbox-hosted .deb were tampered with, arbitrary code would run on the user's system. This is a textbook medium-severity AUR concern — not clearly malicious, but an executed binary from an unofficial, mutable, personally-controlled host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Slava Zubik
    
      2
    
      3pkgname=zvvonlinemusic
    
      4pkgver=0.6
    
      5pkgrel=5
    
      6pkgdesc="Online music player"
    
      7arch=('i386' 'x86_64')
    
      8url="https://zvvubuntu.blogspot.com"
    
      9license=('custom')
    
      10depends=('python-pyqt5' 'vlc') 
    
      11
    
      12source=("${pkgname}_${pkgver}.deb::https://www.dropbox.com/s/2af2ls7jmug9ca2/zvvonlinemusic_06.deb?dl=0"
    
      13"zvvonlinemusic" "ZVVOnlineMusic.desktop")
    
      14md5sums=('d29e3701467a694676566fbb2a8bf409'
    
      15         '5983b546cc455df767ac3767008c69ff'
    
      16         'e5bd3b3664e3ae853b42947a08078137')
    
      17
    
      18package() {
    
      19  cd "${srcdir}"
    
      20  bsdtar -xf data.tar.xz -C "$pkgdir"
    
      21  install -Dm755 zvvonlinemusic $pkgdir/usr/bin/zvvonlinemusic
    
      22  install -Dm755 ZVVOnlineMusic.desktop $pkgdir/usr/share/applications/zvvonlinemusic.desktop
    
      23chmod -R 755 "${pkgdir}"/usr/
    
      24  chmod -R 755 "${pkgdir}"/usr/share/zvvonlinemusic/
    
      25  chmod -R 755 "${pkgdir}"/usr/share/icons/
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2