advantagescope-git

LOW

maintainer manganeese 0 votes scanned 2026-10-03 00:23:04.761738

View on AUR

Why flagged

The npx command runs electron-builder to build the project from its own source; this is a standard part of the build process for Electron apps and does not execute untrusted remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs electron-builder to build the project from its own source; this is a standard part of the build process for Electron apps and does not execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:66 npx electron-builder build --linux --"${!CARCH}" --dir $dist \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: manganeese <mangoiscute95@gmail.com>
    
      2# Contributor: Noah Heller <softwareenginer@pm.me>
    
      3_emsdk=4.0.12
    
      4pkgname=advantagescope-git
    
      5pkgver=27.0.0.ralpha.5.9.g058f8f6e
    
      6pkgrel=1
    
      7epoch=
    
      8pkgdesc="robot diagnostics, log review/analysis, and data visualization application tool"
    
      9arch=(x86_64)
    
      10url="https://github.com/Mechanical-Advantage/AdvantageScope"
    
      11license=("LicenseRef-BSD-3.0-Clause-Noninfringement")
    
      12groups=()
    
      13_electron=electron39
    
      14depends=("$_electron" at-spi2-core bash glibc gtk3 hicolor-icon-theme libgcc libnotify libsecret libstdc++ libxss libxtst nss python3 xdg-utils)
    
      15makedepends=(emscripten git npm)
    
      16checkdepends=()
    
      17optdepends=()
    
      18provides=()
    
      19conflicts=(advantagescope)
    
      20replaces=()
    
      21backup=()
    
      22options=()
    
      23install=
    
      24changelog=
    
      25source=("git+$url.git"
    
      26        "advantagescope-git.desktop"
    
      27        "remove-version.patch")
    
      28noextract=()
    
      29b2sums=('SKIP'
    
      30        '9a501c0358f06bdea2802fa6e783cec578171fc854c030e2bd6be53640d91948a6e32feec6a098ffdbca269f31da1102d4383bc47f5fe23446e90d211a23ac14'
    
      31        '49e71a8305de082ed17af8ff82468e720325330ec778e81a915c0cd2cd0a01a011d2c2eb0ab6e307487d9abf569082628762a3fe5436055aa468f8728052d1ae')
    
      32validpgpkeys=()
    
      33
    
      34prepare() {
    
      35  _ver="$(</usr/lib/${_electron}/version)"
    
      36  cd AdvantageScope
    
      37  npm pkg set homepage="https://github.com/Mechanical-Advantage/AdvantageScope"
    
      38  npm pkg set version="${pkgver/.r/+r}"
    
      39  # apply all patches
    
      40  local src
    
      41  for src in "${source[@]}"; do
    
      42    src="${src%%::*}"
    
      43    src="${src##*/}"
    
      44    [[ $src = *.patch ]] || continue
    
      45    echo "Apply patch $src..."
    
      46    patch -Np1 < "../$src"
    
      47  done
    
      48  # allow git sources (they are depended on)
    
      49  # need to do a scriptless fetch before a normal one to make `youtube-dl-exec` work
    
      50  NPM_CONFIG_ALLOW_GIT=all npm ci --ignore-scripts
    
      51  NPM_CONFIG_ALLOW_GIT=all npm install
    
      52}
    
      53
    
      54pkgver() {
    
      55  cd "AdvantageScope"
    
      56  printf "%s" "$(git describe --tags | cut -c2- | sed 's+-+.r+' | tr - .)"
    
      57}
    
      58
    
      59build() {
    
      60  cd AdvantageScope
    
      61  local x86_64=x64
    
      62  npm run compile
    
      63  npm run wasm:compile
    
      64  npm run docs:build-embed
    
      65  export NODE_OPTIONS="--max-old-space-size=4096"
    
      66  npx electron-builder build --linux --"${!CARCH}" --dir $dist \
    
      67    -c.electronDist=/usr/lib/"$_electron" \
    
      68    -c.electronVersion="$_ver"
    
      69}
    
      70
    
      71package() {
    
      72  local x86_64=linux-unpacked
    
      73  install -Dm644 -t "${pkgdir}/usr/share/applications" "${pkgname}.desktop"
    
      74  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}" <<EOF
    
      75#! /usr/bin/sh
    
      76exec $_electron "/usr/lib/${pkgname}/app.asar" "\$@"
    
      77EOF
    
      78  cd AdvantageScope
    
      79  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/$pkgname/LICENSE"
    
      80  install -d "${pkgdir}/usr/lib/${pkgname}/"
    
      81  cp -r dist/${!CARCH}/resources/* "${pkgdir}/usr/lib/${pkgname}"
    
      82  cd icons/app/app-icons-linux
    
      83  for i in *x*.png; do
    
      84    local dir=${i%.png}
    
      85    dir=${dir#icon_}
    
      86    install -Dm6444 "$i" "${pkgdir}/usr/share/icons/hicolor/${dir}/apps/advantagescope.png"
    
      87  done
    
      88}
    
      89
    
      90# vim:set ts=2 sw=2 et:
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2