athas

LOW

maintainer lapsus 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx command builds the project's own frontend using Vite from the verified source tarball; this is a standard build step, not execution of a remote package.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx command builds the project's own frontend using Vite from the verified source tarball; this is a standard build step, not execution of a remote package.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:70 npx vite build

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Juan Roa <hello@juanroa.dev>
    
      2pkgname=athas
    
      3pkgver=0.13.0
    
      4pkgrel=1
    
      5pkgdesc="Lightweight code editor built with React, TypeScript, and Tauri"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://athas.dev"
    
      8license=('AGPL-3.0-or-later')
    
      9depends=('gtk3' 'hicolor-icon-theme' 'libayatana-appindicator' 'openssl' 'webkit2gtk-4.1')
    
      10makedepends=('bun' 'cmake' 'npm' 'rust')
    
      11conflicts=('athas-bin')
    
      12_source_name=athas
    
      13source=("${_source_name}-${pkgver}.tar.gz::https://github.com/athasdev/athas/archive/refs/tags/v${pkgver}.tar.gz"
    
      14        '0001-add-missing-js-deps-and-swift-cli-override.patch'
    
      15        '0002-add-packaging-tree-sitter-bootstrap-script.patch')
    
      16sha256sums=('c9c3d3f037a296ec625c06a5055654228e16252b26054d735906b6aaa47219fe'
    
      17            '2f380497a9708d316e82457120737f08c0c08c708ef70d559a4190a57d966f85'
    
      18            'bc65eec041814fbab5b7e4336d633abe6975227cd630e92ddf07f69a3624e492')
    
      19
    
      20_builddir="${_source_name}-${pkgver}"
    
      21
    
      22latestver() {
    
      23	gh api --paginate repos/athasdev/athas/releases --jq \
    
      24		'.[] | select(.prerelease == false and .draft == false) | .tag_name' |
    
      25		sed -nE 's/^v?([0-9]+(\.[0-9]+)*)$/\1/p' |
    
      26		sort -V |
    
      27		tail -1
    
      28}
    
      29
    
      30prepare() {
    
      31	cd "${_builddir}"
    
      32
    
      33	local cargo_home="${srcdir}/cargo"
    
      34
    
      35	rm -f scripts/bootstrap-tree-sitter-cli.sh
    
      36
    
      37	patch -Np1 < "${srcdir}/0001-add-missing-js-deps-and-swift-cli-override.patch"
    
      38	patch -Np1 < "${srcdir}/0002-add-packaging-tree-sitter-bootstrap-script.patch"
    
      39
    
      40	export CARGO_HOME="${cargo_home}"
    
      41	mkdir -p "${cargo_home}"
    
      42}
    
      43
    
      44build() {
    
      45	cd "${_builddir}"
    
      46
    
      47	local cargo_home="${srcdir}/cargo"
    
      48	local cargo_target="${srcdir}/target"
    
      49	local debug_prefix="/usr/src/debug/${pkgname}"
    
      50
    
      51	export CFLAGS="${CFLAGS/-flto=auto/}"
    
      52	export CXXFLAGS="${CXXFLAGS/-flto=auto/}"
    
      53	export LDFLAGS="${LDFLAGS/-flto=auto/}"
    
      54	export CFLAGS="${CFLAGS} -ffile-prefix-map=${srcdir}=${debug_prefix}"
    
      55	export CXXFLAGS="${CXXFLAGS} -ffile-prefix-map=${srcdir}=${debug_prefix}"
    
      56	export RUSTFLAGS="${RUSTFLAGS:+${RUSTFLAGS} }--remap-path-prefix=${srcdir}=${debug_prefix}"
    
      57	export CARGO_HOME="${cargo_home}"
    
      58	export CARGO_TARGET_DIR="${cargo_target}"
    
      59	export OPENSSL_NO_VENDOR=1
    
      60	export npm_config_fetch_retries=5
    
      61	export npm_config_fetch_retry_maxtimeout=300000
    
      62	export npm_config_fetch_retry_mintimeout=20000
    
      63	export CXXFLAGS="${CXXFLAGS} -std=gnu++20"
    
      64
    
      65	npm install --allow-git=all --legacy-peer-deps --install-strategy=nested --ignore-scripts
    
      66	bash scripts/bootstrap-tree-sitter-cli.sh "${CARCH}"
    
      67
    
      68	npm rebuild tree-sitter-swift
    
      69	bun scripts/postinstall.ts
    
      70	npx vite build
    
      71	cargo build --release --manifest-path src-tauri/Cargo.toml
    
      72}
    
      73
    
      74package() {
    
      75	cd "${_builddir}"
    
      76
    
      77	local cargo_target="${srcdir}/target"
    
      78
    
      79	install -Dm755 "${cargo_target}/release/athas" "${pkgdir}/usr/bin/${pkgname}"
    
      80	install -d "${pkgdir}/usr/lib/Athas"
    
      81	cp -r src/extensions/bundled "${pkgdir}/usr/lib/Athas/"
    
      82
    
      83	install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      84	install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      85
    
      86	install -Dm644 src-tauri/icons/32x32.png "${pkgdir}/usr/share/icons/hicolor/32x32/apps/${pkgname}.png"
    
      87	install -Dm644 src-tauri/icons/128x128.png "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${pkgname}.png"
    
      88	install -Dm644 src-tauri/icons/128x128@2x.png "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
    
      89	install -Dm644 src-tauri/icons/icon.png "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
    
      90
    
      91	install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<'EOF'
    
      92[Desktop Entry]
    
      93Type=Application
    
      94Name=Athas
    
      95Comment=Lightweight code editor built with Tauri
    
      96Exec=athas %U
    
      97Icon=athas
    
      98Terminal=false
    
      99Categories=Development;IDE;
    
      100EOF
    
      101}
    
      102

Changes since previous scan

--- PKGBUILD @ 2026-09-02 00:02
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,6 +1,6 @@
 # Maintainer: Juan Roa <hello@juanroa.dev>
 pkgname=athas
-pkgver=0.12.0
+pkgver=0.13.0
 pkgrel=1
 pkgdesc="Lightweight code editor built with React, TypeScript, and Tauri"
 arch=('x86_64' 'aarch64')
@@ -13,8 +13,8 @@
 source=("${_source_name}-${pkgver}.tar.gz::https://github.com/athasdev/athas/archive/refs/tags/v${pkgver}.tar.gz"
         '0001-add-missing-js-deps-and-swift-cli-override.patch'
         '0002-add-packaging-tree-sitter-bootstrap-script.patch')
-sha256sums=('70d935e3b1993026c82368dd6cbfb206468a2ee5e7d06ad650e475b5304c7e77'
-            'c6b0ea08e29128a237e7e5360ed3f37baa404b279a8179940a35602c45fac4ff'
+sha256sums=('c9c3d3f037a296ec625c06a5055654228e16252b26054d735906b6aaa47219fe'
+            '2f380497a9708d316e82457120737f08c0c08c708ef70d559a4190a57d966f85'
             'bc65eec041814fbab5b7e4336d633abe6975227cd630e92ddf07f69a3624e492')
 
 _builddir="${_source_name}-${pkgver}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 13:50:58	Medium	1
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2