aionui

LOW

maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The use of bunx to run electron-builder and electron-vite is part of the standard build process for an Electron application and targets development tools from the project's own source tree, not arbitrary remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The use of bunx to run electron-builder and electron-vite is part of the standard build process for an Electron application and targets development tools from the project's own source tree, not arbitrary remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:91 bunx electron-builder install-app-deps
PKGBUILD:107 bunx electron-vite build --config packages/desktop/electron.vite.config.ts
PKGBUILD:113 bunx electron-builder --linux dir --"${TARGET_ARCH}" -c.electronDist="${ELECTRON_DIST}" --config packages/desktop/electron-builder.yml

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=aionui
    
      3_pkgname=AionUi
    
      4pkgver=2.2.1
    
      5_electronversion=37
    
      6_nodeversion=22
    
      7pkgrel=1
    
      8pkgdesc="Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more.(Use system-wide electron)"
    
      9arch=(
    
  'aarch64'
    
  'x86_64'
    
      12)
    
      13url="https://www.aionui.com/"
    
      14_ghurl="https://github.com/iOfficeAI/AionUi"
    
      15license=('Apache-2.0')
    
      16conflicts=("${pkgname}-bin")
    
      17depends=(
    
  "electron${_electronversion}"
    
  'python'
    
  'nodejs'
    
  'python-typing_extensions'
    
  'python-packaging'
    
      23)
    
      24makedepends=(
    
  'bun'
    
  'nvm'
    
  'gendesk'
    
  'curl'
    
  'git'
    
  'jq'
    
      31)
    
      32source=(
    
  "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
    
  "${pkgname}.sh"
    
      35)
    
      36sha256sums=('d14b551a73d8b2992a1ee6d7a0be9ca5df7c390495e76904b353a25d34033753'
    
          'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      38_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      43}
    
      44_get_app_dir() {
    
  find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      46}
    
      47_get_electron_version() {
    
  _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -name "node_modules" \
    
      -exec jq -r '.devDependencies.electron // empty' {} + 2>/dev/null | grep -v "^$" | head -n 1)
    
  _elec_ver=$(echo "${_elec_ver}" | sed 's/[^0-9.]//g')
    
  _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
    
  echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
    
      53}
    
      54_set_build_env() {
    
  export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  export HOME="${srcdir}/.electron-gyp"
    
  export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
    
  export NPM_CONFIG_MAXSOCKETS=32
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      {
    
          export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
    
          export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
    
          export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
    
          export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
    
      }
    
      find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
    
  fi
    
      70}
    
      71prepare() {
    
  cd "${srcdir}/${_pkgname}-${pkgver}"
    
  _get_electron_version
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${pkgname}/g
    
  " "${srcdir}/${pkgname}.sh"
    
  gendesk -q -f -n \
    
      --pkgname="${pkgname}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="System" \
    
      --name="${pkgname}" \
    
      --exec="${pkgname} %U"
    
  _set_build_env
    
  _ensure_local_nvm
    
  find packages -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname}\'/g" {} +
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  bun run postinstall || true
    
  bunx electron-builder install-app-deps
    
      92}
    
      93build() {
    
  cd "${srcdir}/${_pkgname}-${pkgver}"
    
  _set_build_env
    
  _ensure_local_nvm
    
  
    
  # Determine target architecture
    
  if [[ "${CARCH}" == "x86_64" ]]; then
    
      TARGET_ARCH="x64"
    
  elif [[ "${CARCH}" == "aarch64" ]]; then
    
      TARGET_ARCH="arm64"
    
  else
    
      TARGET_ARCH="x64"
    
  fi
    
  
    
  bunx electron-vite build --config packages/desktop/electron.vite.config.ts
    
  node scripts/build-mcp-servers.js
    
  node -e "const { prepareAioncore } = require('./packages/shared-scripts/src/prepare-aioncore.js'); \
    
      const { resolveAioncoreVersion } = require('./scripts/resolveAioncoreVersion.js'); \
    
      prepareAioncore({ projectRoot: process.cwd(), platform: 'linux', arch: '${TARGET_ARCH}'});"
    
  node scripts/prepareHubResources.js
    
  bunx electron-builder --linux dir --"${TARGET_ARCH}" -c.electronDist="${ELECTRON_DIST}" --config packages/desktop/electron-builder.yml
    
      114}
    
      115package() {
    
  install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
    
  local _app_dir=$(_get_app_dir)
    
  cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
    
  rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
    
  install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/resources/app.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
  install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      124}
    
      125

Changes since previous scan

--- PKGBUILD @ 2026-09-10 00:22
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
 # Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
 pkgname=aionui
 _pkgname=AionUi
-pkgver=2.1.61
+pkgver=2.2.1
 _electronversion=37
 _nodeversion=22
 pkgrel=1
@@ -17,7 +17,9 @@
 depends=(
     "electron${_electronversion}"
     'python'
-    'libsecret'
+    'nodejs'
+    'python-typing_extensions'
+    'python-packaging'
 )
 makedepends=(
     'bun'
@@ -31,7 +33,7 @@
     "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
     "${pkgname}.sh"
 )
-sha256sums=('cbf788ae0bcd75e80c691dcca0f918b168716ad7d56de7de511792ae13f06819'
+sha256sums=('d14b551a73d8b2992a1ee6d7a0be9ca5df7c390495e76904b353a25d34033753'
             'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
 _ensure_local_nvm() {
     local NVM_DIR="${srcdir}/.nvm"
@@ -83,6 +85,7 @@
         --exec="${pkgname} %U"
     _set_build_env
     _ensure_local_nvm
+    find packages -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname}\'/g" {} +
     sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
     bun run postinstall || true
     bunx electron-builder install-app-deps
@@ -90,14 +93,31 @@
 build() {
     cd "${srcdir}/${_pkgname}-${pkgver}"
     _set_build_env
-    _ensure_local_nvm   
-    bun run dist:linux
+    _ensure_local_nvm
+    
+    # Determine target architecture
+    if [[ "${CARCH}" == "x86_64" ]]; then
+        TARGET_ARCH="x64"
+    elif [[ "${CARCH}" == "aarch64" ]]; then
+        TARGET_ARCH="arm64"
+    else
+        TARGET_ARCH="x64"
+    fi
+    
+    bunx electron-vite build --config packages/desktop/electron.vite.config.ts
+    node scripts/build-mcp-servers.js
+    node -e "const { prepareAioncore } = require('./packages/shared-scripts/src/prepare-aioncore.js'); \
+        const { resolveAioncoreVersion } = require('./scripts/resolveAioncoreVersion.js'); \
+        prepareAioncore({ projectRoot: process.cwd(), platform: 'linux', arch: '${TARGET_ARCH}'});"
+    node scripts/prepareHubResources.js
+    bunx electron-builder --linux dir --"${TARGET_ARCH}" -c.electronDist="${ELECTRON_DIST}" --config packages/desktop/electron-builder.yml
 }
 package() {
     install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
     install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
     local _app_dir=$(_get_app_dir)
     cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
+    rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
     install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/resources/app.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
     install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
     install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 03:20:13	Medium	1
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 03:49:31	Medium	1
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2