astrofox

maintainer sukanka · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The 'yarn add webpack' call installs webpack from the official npm registry, not from an unofficial or personal host. Webpack is a well-known, widely-used build tool. The reason it's added separately is that 'yarn install --prod' skips devDependencies, and webpack is needed for the build steps. This is a common workaround pattern in AUR packages that use system electron and need to avoid bundling the full devDependency tree. The source tarball comes from the official GitHub upstream tag, and the patches come from GitHub's own patch/compare endpoints. There is no binary pulled from an unofficial host, no obfuscation, and no exfiltration. The main concern is that yarn fetches packages from the internet at build time (not pinned via lockfile in the PKGBUILD), which is sloppy but standard practice for AUR JS-ecosystem packages. This does not rise to medium severity since webpack itself is a legitimate, official npm package from the standard registry, not an 'undeclared external package from an unofficial host'.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The 'yarn add webpack' call installs webpack from the official npm registry, not from an unofficial or personal host. Webpack is a well-known, widely-used build tool. The reason it's added separately is that 'yarn install --prod' skips devDependencies, and webpack is needed for the build steps. This is a common workaround pattern in AUR packages that use system electron and need to avoid bundling the full devDependency tree. The source tarball comes from the official GitHub upstream tag, and the patches come from GitHub's own patch/compare endpoints. There is no binary pulled from an unofficial host, no obfuscation, and no exfiltration. The main concern is that yarn fetches packages from the internet at build time (not pinned via lockfile in the PKGBUILD), which is sloppy but standard practice for AUR JS-ecosystem packages. This does not rise to medium severity since webpack itself is a legitimate, official npm package from the standard registry, not an 'undeclared external package from an unofficial host'.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:57 yarn add webpack

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: sukanka <su975853527 at gmail dot com>
    
      2
    
      3pkgname=astrofox
    
      4pkgver=1.4.0
    
      5pkgrel=5
    
      6_electron=electron34
    
      7pkgdesc="A motion graphics program that lets turn audio into amazing videos"
    
      8arch=('any')
    
      9url="https://astrofox.io"
    
      10license=('MIT')
    
      11depends=(${_electron} ffmpeg)
    
      12makedepends=(yarn asar sed 'jq' 'moreutils')
    
      13source=("${pkgname}-${pkgver}.tar.gz::https://github.com/astrofox-io/astrofox/archive/refs/tags/v${pkgver}.tar.gz"
    
      14    ${pkgname}.sh
    
      15    ${pkgname}.desktop
    
      16    "update-master.patch::https://github.com/astrofox-io/astrofox/compare/v1.4.0...master.patch"
    
      17    "electron30.patch::https://patch-diff.githubusercontent.com/raw/astrofox-io/astrofox/pull/116.patch"
    
      18)
    
      19sha512sums=('bf0adc3ea6f8a388c3e08b93ba70fdb950ec36cf847a9382e516e735506a8f0c0ebf1ae03315d13a29382aa70f684b4742443891d5c661ac839b9a8300b7a195'
    
      20            '74cc07387771a9c1a8255f0ec0bb28c9527a8a15ff344977b803e8dbaba14af29de4e04747da04ca7204f2e22fe0882030d5c6db9a1bd50e482e6de4b025713b'
    
      21            'b4b3828b1216adf3cf1105074b64bfbd6fd440fb61da7a389a3e6b172e6607c90de3218e6762997344d861dc10fbc2b3ecbccf02d01a292918b89eed3903bcf2'
    
      22            'fbc51fb7a52560d8ed9c883f15ccf20432361cce6b59af2a737bbe4d67111361e3fbdd0080120dcd9482cfced2880a93712261d20b60862af3e2d23cbac7a717'
    
      23            '0555e946d11f3bae064f9256da51fe1306df8eaad9771aa46a52823dd3655e6d735c1af45688e1e48c4e22bca51ffad0e0deb6cf821554409a694b336848368b')
    
      24
    
      25prepare() {
    
      26    # patch for system ffmpeg
    
      27    cd $srcdir/${pkgname}-${pkgver}
    
      28    patch --strip=1 --ignore-whitespace <../update-master.patch
    
      29    patch --strip=1 --ignore-whitespace <../electron30.patch
    
      30
    
      31    # system ffmpeg
    
      32    sed -i "s#^export const FFMPEG_BINARY.*#export const FFMPEG_BINARY = '/usr/bin/ffmpeg';#g" \
    
      33        src/main/environment.js
    
      34    # set electron in script
    
      35    sed -i "s|_ELECTRON_|${_electron}|g" ${srcdir}/${pkgname}.sh
    
      36
    
      37    # system electron
    
      38    local electronDist="/usr/lib/${_electron}"
    
      39    local electronVersion="$(<$electronDist/version)"
    
      40    jq ".devDependencies.electron = \"$electronVersion\"" package.json | sponge package.json
    
      41    jq ".build.electronDist = \"$electronDist\"" package.json | sponge package.json
    
      42    jq ".build.electronVersion = \"$electronVersion\"" package.json | sponge package.json
    
      43
    
      44    # disable in-app update
    
      45    sed -i 's|"autoUpdate": true,|"autoUpdate": false,|g' src/config/app.json
    
      46    sed -i 's|"checkForUpdates": true,|"checkForUpdates": false,|g' src/config/app.json
    
      47
    
      48    # fix entry
    
      49    jq ".version = \"$pkgver\"" package.json | sponge package.json
    
      50    jq '.main = "main.js"' package.json | sponge package.json
    
      51}
    
      52build() {
    
      53    cd $srcdir/${pkgname}-${pkgver}
    
      54    export HOME=$srcdir
    
      55
    
      56    yarn install --prod
    
      57    yarn add webpack
    
      58    yarn run build-main && yarn run build-prod
    
      59
    
      60    cp package.json app/
    
      61
    
      62    rm app/*.map
    
      63    cp src/build/app/dev-app-update.yml app/app-update.yml
    
      64    asar pack app/ ${pkgname}.asar
    
      65
    
      66}
    
      67
    
      68package() {
    
      69    cd $srcdir/${pkgname}-${pkgver}
    
      70    install -Dm755 $srcdir/${pkgname}.sh ${pkgdir}/usr/bin/${pkgname}
    
      71    install -Dm644 ${pkgname}.asar ${pkgdir}/usr/share/${pkgname}/${pkgname}.asar
    
      72    install -Dm644 build/icons/512x512.png ${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png
    
      73    install -Dm644 $srcdir/${pkgname}.desktop ${pkgdir}/usr/share/applications/${pkgname}.desktop
    
      74}
    
      75# vim: ts=2 sw=2 et:
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2