azeron-software

maintainer renatoi · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npm and npx commands are used to build the project's own dependencies from its official repository, not to install arbitrary remote code; the sources are from trusted project forges (GitHub) and the actions are part of standard Electron app packaging.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm and npx commands are used to build the project's own dependencies from its official repository, not to install arbitrary remote code; the sources are from trusted project forges (GitHub) and the actions are part of standard Electron app packaging.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:29 npm install node-hid@2.2.0

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:31 npx @electron/rebuild -f -w node-hid -m app -v "${_electron_ver}"
PKGBUILD:49 npx electron-builder --linux dir

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Renato de Oliveira <renatoi at github>
    
      2pkgname=azeron-software
    
      3pkgver=1.5.6
    
      4pkgrel=7
    
      5pkgdesc='Configuration tool for Azeron keypads (unofficial Linux repackage)'
    
      6arch=('x86_64')
    
      7url='https://github.com/renatoi/azeron-linux'
    
      8license=('custom:proprietary')
    
      9depends=('hidapi' 'libusb' 'gtk3' 'nss' 'alsa-lib' 'python' 'usbutils')
    
      10makedepends=('npm' 'nodejs' 'p7zip')
    
      11optdepends=('dfu-util: firmware updates'
    
      12            'python-pyusb: standalone XInput drain script (for use without the app)')
    
      13options=('!strip')
    
      14_electron_ver=30.0.9
    
      15source=("${pkgname}-${pkgver}-${pkgrel}.tar.gz::https://github.com/renatoi/azeron-linux/archive/refs/tags/v${pkgver}.tar.gz"
    
      16        "electron-${_electron_ver}.zip::https://github.com/electron/electron/releases/download/v${_electron_ver}/electron-v${_electron_ver}-linux-x64.zip")
    
      17noextract=("electron-${_electron_ver}.zip")
    
      18sha256sums=('SKIP'
    
      19            'SKIP')
    
      20
    
      21prepare() {
    
      22    cd "azeron-linux-${pkgver}"
    
      23
    
      24    # Install root build dependencies
    
      25    npm install --ignore-scripts
    
      26
    
      27    # Rebuild node-hid for Linux targeting Electron
    
      28    cd app
    
      29    npm install node-hid@2.2.0
    
      30    cd ..
    
      31    npx @electron/rebuild -f -w node-hid -m app -v "${_electron_ver}"
    
      32
    
      33    # Apply Linux patches
    
      34    node scripts/patch-main.js
    
      35
    
      36    # Remove Windows-only files
    
      37    rm -f app/node_modules/ps-list/vendor/fastlist*.exe 2>/dev/null || true
    
      38    rm -rf app/dist/win-unpacked 2>/dev/null || true
    
      39}
    
      40
    
      41build() {
    
      42    cd "azeron-linux-${pkgver}"
    
      43
    
      44    # Cache the electron zip so electron-builder doesn't re-download
    
      45    mkdir -p "${HOME}/.cache/electron"
    
      46    cp "${srcdir}/electron-${_electron_ver}.zip" \
    
      47       "${HOME}/.cache/electron/electron-v${_electron_ver}-linux-x64.zip" 2>/dev/null || true
    
      48
    
      49    npx electron-builder --linux dir
    
      50}
    
      51
    
      52package() {
    
      53    cd "azeron-linux-${pkgver}"
    
      54
    
      55    local _appdir="${pkgdir}/opt/${pkgname}"
    
      56
    
      57    # Install app
    
      58    install -dm755 "${_appdir}"
    
      59    cp -r output/linux-unpacked/* "${_appdir}/"
    
      60
    
      61    # Binary symlink
    
      62    install -dm755 "${pkgdir}/usr/bin"
    
      63    ln -s "/opt/${pkgname}/azeron-software-v1" "${pkgdir}/usr/bin/azeron-software"
    
      64
    
      65    # Desktop file
    
      66    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/azeron-software.desktop" <<DESKTOP
    
      67[Desktop Entry]
    
      68Name=Azeron Software
    
      69Comment=Configuration tool for Azeron keypads
    
      70Exec=/opt/${pkgname}/azeron-software-v1 --ozone-platform=x11 --no-sandbox %U
    
      71Icon=azeron-software
    
      72Terminal=false
    
      73Type=Application
    
      74Categories=Utility;HardwareSettings;
    
      75DESKTOP
    
      76
    
      77    # Icon
    
      78    install -Dm644 build/icon.png "${pkgdir}/usr/share/pixmaps/azeron-software.png"
    
      79
    
      80    # Udev rules
    
      81    install -Dm644 assets/99-azeron.rules "${pkgdir}/usr/lib/udev/rules.d/99-azeron.rules"
    
      82
    
      83    # License
    
      84    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<LICENSE
    
      85This is an unofficial repackage of the Azeron keypad configuration software.
    
      86The original Azeron Software is proprietary software by Azeron SIA.
    
      87Firmware binaries are property of Azeron LTD.
    
      88See https://azeron.eu for more information.
    
      89LICENSE
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 07:31:44	MEDIUM	2
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3