3dgenstudio-git

maintainer corrm · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The base64-encoded launcher script is part of the legitimate project's distribution mechanism to start the application and open the UI in the browser; it does not execute untrusted remote code or exfiltrate data, and the source is from a known project repository.

Triggered rules

LOW AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The base64-encoded launcher script is part of the legitimate project's distribution mechanism to start the application and open the UI in the browser; it does not execute untrusted remote code or exfiltrate data, and the source is from a known project repository.

PKGBUILD:43 base64 -d > "$pkgdir/usr/bin/3dgenstudio" <<< "IyEvYmluL2Jhc2gKIyBTdGFydHMgdGhlIHByb2R1Y3Rpb24gc2VydmVyIChzZXJ2ZXMgdGhlIGJ1aWx0IGRpc3QvIFVJICsgQVBJcykgYW5kIG9wZW5zIGl0CiMgaW4gdGhlIGJyb3dzZXIuIElmIGl0J3MgYWxyZWFkeSBydW5uaW5nLCBqdXN0IG9wZW5zIHRoZSBicm93c2VyLiBBcHAgZGF0YQojIChzcWxpdGUsIGFzc2V0cykgaXMgd3JpdHRlbiB1bmRlciBwcm9jZXNzLmN3ZCgpL2RhdGEg4oCUIGEgcGVyLXVzZXIgd3JpdGFibGUgZGlyLgphcHA9L29wdC8zZGdlbnN0dWRpby1naXQKZGF0YT0iJHtYREdfREFUQV9IT01FOi0kSE9NRS8ubG9jYWwvc2hhcmV9LzNkZ2Vuc3R1ZGlvIgpwb3J0PSIke1BPUlQ6LTMwMDF9Igp1cmw9Imh0dHA6Ly9sb2NhbGhvc3Q6JHBvcnQiCm1rZGlyIC1wICIkZGF0YSIKY2QgIiRkYXRhIgpfdXAoKSB7IChleGVjIDM8PiIvZGV2L3RjcC8xMjcuMC4wLjEvJHBvcnQiKSAyPi9kZXYvbnVsbDsgfQppZiBfdXA7IHRoZW4gZXhlYyB4ZGctb3BlbiAiJHVybCI7IGZpCiggZm9yIF8gaW4gJChzZXEgMSA1MCk7IGRvIF91cCAmJiB7IHhkZy1vcGVuICIkdXJsIjsgYnJlYWs7IH07IHNsZWVwIDAuMjsgZG9uZSApICYKZWNobyAiM2RnZW5zdHVkaW86IHN0YXJ0aW5nIG9uICR1cmwiCmV4ZWMgbm9kZSAiJGFwcC9zZXJ2ZXIuanMi"

PKGBUILD

1 offending line(s) highlighted

      1pkgname=3dgenstudio-git
    
      2pkgver=r98bdc4a
    
      3pkgrel=1
    
      4pkgdesc="AI image-to-3D model generation studio (Vite UI + Node/Python backend)"
    
      5arch=(x86_64)
    
      6url="https://github.com/visualbruno/3DGenStudio"
    
      7license=(custom)
    
      8depends=("nodejs" "xdg-utils")
    
      9makedepends=("git" "npm")
    
      10optdepends=("python: local 3D-generation backend (python-server)")
    
      11conflicts=("3dgenstudio")
    
      12provides=("3dgenstudio")
    
      13
    
      14source=("3dgenstudio-git::git+https://github.com/visualbruno/3DGenStudio.git#branch=main")
    
      15sha256sums=('SKIP')
    
      16
    
      17pkgver() {
    
      18cd "$srcdir/3dgenstudio-git"
    
      19printf 'r%s.%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      20}
    
      21
    
      22build() {
    
      23# Production build (vite build -> dist/)
    
      24cd "$srcdir/3dgenstudio-git"
    
      25npm ci
    
      26npm run build
    
      27# Strip devDependencies from node_modules
    
      28cd "$srcdir/3dgenstudio-git"
    
      29npm prune --omit=dev
    
      30}
    
      31
    
      32package() {
    
      33# Install production tree
    
      34cd "$srcdir/3dgenstudio-git"
    
      35install -d "$pkgdir/opt/3dgenstudio-git"
    
      36cp -a --no-target-directory . "$pkgdir/opt/3dgenstudio-git"
    
      37# Keep the production build + server; drop dev source, tooling, VCS, secrets.
    
      38cd "$pkgdir/opt/3dgenstudio-git"
    
      39rm -rf .git .env src public .github .vscode .claude .gitignore \
    
      40       vite.config.* eslint.config.js tsconfig*.json
    
      41# Install launcher
    
      42install -d "$pkgdir/usr/bin"
    
      43base64 -d > "$pkgdir/usr/bin/3dgenstudio" <<< "IyEvYmluL2Jhc2gKIyBTdGFydHMgdGhlIHByb2R1Y3Rpb24gc2VydmVyIChzZXJ2ZXMgdGhlIGJ1aWx0IGRpc3QvIFVJICsgQVBJcykgYW5kIG9wZW5zIGl0CiMgaW4gdGhlIGJyb3dzZXIuIElmIGl0J3MgYWxyZWFkeSBydW5uaW5nLCBqdXN0IG9wZW5zIHRoZSBicm93c2VyLiBBcHAgZGF0YQojIChzcWxpdGUsIGFzc2V0cykgaXMgd3JpdHRlbiB1bmRlciBwcm9jZXNzLmN3ZCgpL2RhdGEg4oCUIGEgcGVyLXVzZXIgd3JpdGFibGUgZGlyLgphcHA9L29wdC8zZGdlbnN0dWRpby1naXQKZGF0YT0iJHtYREdfREFUQV9IT01FOi0kSE9NRS8ubG9jYWwvc2hhcmV9LzNkZ2Vuc3R1ZGlvIgpwb3J0PSIke1BPUlQ6LTMwMDF9Igp1cmw9Imh0dHA6Ly9sb2NhbGhvc3Q6JHBvcnQiCm1rZGlyIC1wICIkZGF0YSIKY2QgIiRkYXRhIgpfdXAoKSB7IChleGVjIDM8PiIvZGV2L3RjcC8xMjcuMC4wLjEvJHBvcnQiKSAyPi9kZXYvbnVsbDsgfQppZiBfdXA7IHRoZW4gZXhlYyB4ZGctb3BlbiAiJHVybCI7IGZpCiggZm9yIF8gaW4gJChzZXEgMSA1MCk7IGRvIF91cCAmJiB7IHhkZy1vcGVuICIkdXJsIjsgYnJlYWs7IH07IHNsZWVwIDAuMjsgZG9uZSApICYKZWNobyAiM2RnZW5zdHVkaW86IHN0YXJ0aW5nIG9uICR1cmwiCmV4ZWMgbm9kZSAiJGFwcC9zZXJ2ZXIuanMi"
    
      44chmod 755 "$pkgdir/usr/bin/3dgenstudio"
    
      45# Install menu entry + icon
    
      46install -d "$pkgdir/usr/share/applications"
    
      47printf '%s\n' \
    
      48  '[Desktop Entry]' \
    
      49  'Type=Application' \
    
      50  'Name=3D Gen Studio' \
    
      51  'Comment=AI image-to-3D model generation studio' \
    
      52  'Exec=3dgenstudio' \
    
      53  'Icon=3dgenstudio' \
    
      54  'Terminal=false' \
    
      55  'Categories=Graphics;3DGraphics;' \
    
      56  > "$pkgdir/usr/share/applications/3dgenstudio.desktop"
    
      57
    
      58install -Dm644 "$srcdir/3dgenstudio-git/dist/favicon.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/3dgenstudio.png"
    
      59}

Changes since previous scan

--- PKGBUILD @ 2026-07-30 17:15
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,5 +1,5 @@
 pkgname=3dgenstudio-git
-pkgver=r065a887
+pkgver=r98bdc4a
 pkgrel=1
 pkgdesc="AI image-to-3D model generation studio (Vite UI + Node/Python backend)"
 arch=(x86_64)

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	1
2026-08-02 00:16:08	LOW	1
2026-08-01 00:11:18	LOW	1
2026-07-31 23:19:22	LOW	1
2026-07-30 17:15:21	CLEAN	1
2026-07-30 13:14:23	CLEAN	1
2026-07-28 11:38:42	CLEAN	1
2026-07-28 01:36:52	CLEAN	1
2026-07-27 21:35:42	CLEAN	1
2026-07-23 11:23:42	CLEAN	1
2026-07-20 00:19:49	CLEAN	2
2026-07-19 23:12:22	LOW	1
2026-07-17 00:06:16	CLEAN	2
2026-07-16 17:52:43	LOW	1
2026-07-16 13:51:33	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 13:49:03	LOW	2
2026-07-15 00:09:25	LOW	2
2026-07-14 15:45:30	LOW	2
2026-07-14 13:45:26	LOW	1