From 01bc10725a6b0dea5faffe7140202d77768ed942 Mon Sep 17 00:00:00 2001
From: Moraxyc <i@qaq.li>
Date: Fri, 13 Jun 2025 10:53:36 +0800
Subject: [PATCH] alist: mark as insecure

(cherry picked from commit 5fa650c8014849d67c1f7eccb3c50f24b253d329)
---
 pkgs/by-name/al/alist/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/al/alist/package.nix b/pkgs/by-name/al/alist/package.nix
index 77805b365d33..80bd8031389b 100644
--- a/pkgs/by-name/al/alist/package.nix
+++ b/pkgs/by-name/al/alist/package.nix
@@ -103,6 +103,10 @@ buildGoModule rec {
       # alist-web
       mit
     ];
+    knownVulnerabilities = [
+      "Alist was acquired by Bugotech, a company distrusted by the community"
+      "Uses a questionable API server alist.nn.ci for account creation for certain drivers"
+    ];
     maintainers = with lib.maintainers; [ moraxyc ];
     sourceProvenance = with lib.sourceTypes; [
       fromSource