athas

maintainer lapsus · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command runs 'vite build' on the project's own source, which is a standard build step from a trusted, versioned GitHub release; the worst case of a malicious swap is limited to code execution during build, but the source is verifiable and checksummed.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs 'vite build' on the project's own source, which is a standard build step from a trusted, versioned GitHub release; the worst case of a malicious swap is limited to code execution during build, but the source is verifiable and checksummed.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:70 npx vite build

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Juan Roa <hello@juanroa.dev>
    
      2pkgname=athas
    
      3pkgver=0.10.0
    
      4pkgrel=1
    
      5pkgdesc="Lightweight code editor built with React, TypeScript, and Tauri"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://athas.dev"
    
      8license=('AGPL-3.0-or-later')
    
      9depends=('gtk3' 'hicolor-icon-theme' 'libayatana-appindicator' 'openssl' 'webkit2gtk-4.1')
    
      10makedepends=('bun' 'cmake' 'npm' 'rust')
    
      11conflicts=('athas-bin')
    
      12_source_name=athas
    
      13source=("${_source_name}-${pkgver}.tar.gz::https://github.com/athasdev/athas/archive/refs/tags/v${pkgver}.tar.gz"
    
      14        '0001-add-missing-js-deps-and-swift-cli-override.patch'
    
      15        '0002-add-packaging-tree-sitter-bootstrap-script.patch')
    
      16sha256sums=('0d7c6a101e5c01b4c84a0da787ada65e55589a26343d3228fffe36ec40d26a55'
    
      17            '05b94eeed03e6631b704b91206df3529a391f74317b0fcb3897cd554ad58918b'
    
      18            'bc65eec041814fbab5b7e4336d633abe6975227cd630e92ddf07f69a3624e492')
    
      19
    
      20_builddir="${_source_name}-${pkgver}"
    
      21
    
      22latestver() {
    
      23	gh api --paginate repos/athasdev/athas/releases --jq \
    
      24		'.[] | select(.prerelease == false and .draft == false) | .tag_name' |
    
      25		sed -nE 's/^v?([0-9]+(\.[0-9]+)*)$/\1/p' |
    
      26		sort -V |
    
      27		tail -1
    
      28}
    
      29
    
      30prepare() {
    
      31	cd "${_builddir}"
    
      32
    
      33	local cargo_home="${srcdir}/cargo"
    
      34
    
      35	rm -f scripts/bootstrap-tree-sitter-cli.sh
    
      36
    
      37	patch -Np1 < "${srcdir}/0001-add-missing-js-deps-and-swift-cli-override.patch"
    
      38	patch -Np1 < "${srcdir}/0002-add-packaging-tree-sitter-bootstrap-script.patch"
    
      39
    
      40	export CARGO_HOME="${cargo_home}"
    
      41	mkdir -p "${cargo_home}"
    
      42}
    
      43
    
      44build() {
    
      45	cd "${_builddir}"
    
      46
    
      47	local cargo_home="${srcdir}/cargo"
    
      48	local cargo_target="${srcdir}/target"
    
      49	local debug_prefix="/usr/src/debug/${pkgname}"
    
      50
    
      51	export CFLAGS="${CFLAGS/-flto=auto/}"
    
      52	export CXXFLAGS="${CXXFLAGS/-flto=auto/}"
    
      53	export LDFLAGS="${LDFLAGS/-flto=auto/}"
    
      54	export CFLAGS="${CFLAGS} -ffile-prefix-map=${srcdir}=${debug_prefix}"
    
      55	export CXXFLAGS="${CXXFLAGS} -ffile-prefix-map=${srcdir}=${debug_prefix}"
    
      56	export RUSTFLAGS="${RUSTFLAGS:+${RUSTFLAGS} }--remap-path-prefix=${srcdir}=${debug_prefix}"
    
      57	export CARGO_HOME="${cargo_home}"
    
      58	export CARGO_TARGET_DIR="${cargo_target}"
    
      59	export OPENSSL_NO_VENDOR=1
    
      60	export npm_config_fetch_retries=5
    
      61	export npm_config_fetch_retry_maxtimeout=300000
    
      62	export npm_config_fetch_retry_mintimeout=20000
    
      63	export CXXFLAGS="${CXXFLAGS} -std=gnu++20"
    
      64
    
      65	npm install --allow-git=all --legacy-peer-deps --install-strategy=nested --ignore-scripts
    
      66	bash scripts/bootstrap-tree-sitter-cli.sh "${CARCH}"
    
      67
    
      68	npm rebuild tree-sitter-swift
    
      69	bun scripts/postinstall.ts
    
      70	npx vite build
    
      71	cargo build --release --manifest-path src-tauri/Cargo.toml
    
      72}
    
      73
    
      74package() {
    
      75	cd "${_builddir}"
    
      76
    
      77	local cargo_target="${srcdir}/target"
    
      78
    
      79	install -Dm755 "${cargo_target}/release/athas" "${pkgdir}/usr/bin/${pkgname}"
    
      80	install -d "${pkgdir}/usr/lib/Athas"
    
      81	cp -r src/extensions/bundled "${pkgdir}/usr/lib/Athas/"
    
      82
    
      83	install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      84	install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      85
    
      86	install -Dm644 src-tauri/icons/32x32.png "${pkgdir}/usr/share/icons/hicolor/32x32/apps/${pkgname}.png"
    
      87	install -Dm644 src-tauri/icons/128x128.png "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${pkgname}.png"
    
      88	install -Dm644 src-tauri/icons/128x128@2x.png "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
    
      89	install -Dm644 src-tauri/icons/icon.png "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
    
      90
    
      91	install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<'EOF'
    
      92[Desktop Entry]
    
      93Type=Application
    
      94Name=Athas
    
      95Comment=Lightweight code editor built with Tauri
    
      96Exec=athas %U
    
      97Icon=athas
    
      98Terminal=false
    
      99Categories=Development;IDE;
    
      100EOF
    
      101}
    
      102

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Juan Roa <hello@juanroa.dev>
 pkgname=athas
-pkgver=0.9.0
+pkgver=0.10.0
 pkgrel=1
 pkgdesc="Lightweight code editor built with React, TypeScript, and Tauri"
 arch=('x86_64' 'aarch64')
@@ -13,7 +13,7 @@
 source=("${_source_name}-${pkgver}.tar.gz::https://github.com/athasdev/athas/archive/refs/tags/v${pkgver}.tar.gz"
         '0001-add-missing-js-deps-and-swift-cli-override.patch'
         '0002-add-packaging-tree-sitter-bootstrap-script.patch')
-sha256sums=('335dab9e1190a15771ecbcb91dadcd4a0d76c410f9d8ca36eb982d2fb7f5e178'
+sha256sums=('0d7c6a101e5c01b4c84a0da787ada65e55589a26343d3228fffe36ec40d26a55'
             '05b94eeed03e6631b704b91206df3529a391f74317b0fcb3897cd554ad58918b'
             'bc65eec041814fbab5b7e4336d633abe6975227cd630e92ddf07f69a3624e492')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 23:13:22	MEDIUM	1
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 19:52:44	MEDIUM	1