balena-etcher
LOW
maintainer zhullyb
267 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npm install in build() is for the project's own dependencies in a subdirectory (sidecar), which is a normal part of building the application from source; the packages installed (etcher-sdk, ws, lodash) are legitimate and expected for the project.
Triggered rules
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The npm install in build() is for the project's own dependencies in a subdirectory (sidecar), which is a normal part of building the application from source; the packages installed (etcher-sdk, ws, lodash) are legitimate and expected for the project.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:61
npm install --no-package-lock --prefix . etcher-sdk ws lodash
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Matthew McGinn <mamcgi@gmail.com>
2
# Contributor: Håvard Pettersson <mail@haavard.me>
3
# Contributor: Andrew Stubbs <andrew.stubbs@gmail.com>
4
5
pkgname=balena-etcher
6
_pkgname=etcher
7
pkgver=2.1.6
8
pkgrel=1
9
pkgdesc='Flash OS images to SD cards & USB drives, safely and easily'
10
arch=('x86_64' 'i686' 'armv7h' 'aarch64')
11
_github_url='https://github.com/balena-io/etcher'
12
url='https://balena.io/etcher'
13
license=(Apache-2.0)
14
_electron=electron37
15
depends=("${_electron}" "nodejs-lts-jod")
16
makedepends=("npm" "python" 'jq' 'moreutils' 'python-setuptools' 'git')
17
optdepends=("libnotify: for notifications")
18
conflicts=("${_pkgname}"
19
"${_pkgname}-git"
20
"${_pkgname}-bin"
21
)
22
options=('!debug' '!strip')
23
source=("${_github_url}/archive/refs/tags/v${pkgver}.tar.gz"
24
"${pkgname}.desktop"
25
"${pkgname}"
26
"etcher-util"
27
'skip-build-util.patch'
28
)
29
sha256sums=('47e6539ddf8ce6f4ce49787fe9e0fc126b842b7d490eb5744f62d36284f422ce'
30
'6c5fb48aeb636272689c86d7cf9beea4515214636bc617a61c3e8387628b3415'
31
'7482eb18af030eb6d2b44850f23ecb99cd9198f642ac3b22b2f9f2ef0c8944d4'
32
'75ec686b0af8b6f744970cd5f1bfe4c62baf492215d14f43b87da3d492919680'
33
'a64369d70d41a3e9bed9d2260dedcaf76fceb8c654dbf8b6eee947785de2ae45')
34
prepare() {
35
cd "${_pkgname}-${pkgver}"
36
patch --strip=1 <${srcdir}/skip-build-util.patch
37
local electronDist="/usr/lib/${_electron}"
38
local electronVersion="$(<$electronDist/version)"
39
jq ".devDependencies.electron = \"$electronVersion\"" package.json | sponge package.json
40
jq ".build.electronDist = \"$electronDist\"" package.json | sponge package.json
41
jq ".build.electronVersion = \"$electronVersion\"" package.json | sponge package.json
42
sed -i lib/gui/etcher.ts -e "s|process.resourcesPath|'/usr/lib/${pkgname}'|"
43
sed -i ${srcdir}/${pkgname} -e "s|__ELECTRON__|${_electron}|"
44
sed -i "/elevated = 'refused';/d" lib/shared/sudo/linux.ts
45
}
46
47
build() {
48
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
49
export HOME="${srcdir}"
50
export NODE_OPTIONS=--stack-trace-limit=50
51
# skip download of node headers
52
export npm_config_nodedir=/usr/
53
cd "${_pkgname}-${pkgver}"
54
unset MAKEFLAGS
55
56
npm install --no-package-lock
57
npm run package
58
59
# node_modules for our etcher-util wrapper
60
cd "out/sidecar/src"
61
npm install --no-package-lock --prefix . etcher-sdk ws lodash
62
}
63
64
__clean_modules() {
65
local __arch_remove
66
__arch_remove=arm64
67
if [[ "$CARCH" == "aarch64" ]]; then
68
__arch_remove=x64
69
fi
70
cd "${pkgdir}/usr/lib/${pkgname}/utils/node_modules"
71
rm -rf {drivelist,mountutils,xxhash-addon}/build/{config.gypi,Makefile,*.mk,Release/{obj.target,.deps,*.a}}
72
rm -rf lzma-native/prebuilds/{darwin-{arm64,x64},win32-{ia32,x64},linux-${__arch_remove}}
73
rm -rf drivelist/node-addon-api/nothing.target.mk
74
rm -rf usb/prebuilds/{android,win32,darwin}-*
75
case $CARCH in
76
x86_64)
77
rm -rf usb/prebuilds/linux-{arm*,ia32}
78
;;
79
i386)
80
rm -rf usb/prebuilds/linux-{arm*,x64}
81
;;
82
aarch64)
83
rm -rf usb/prebuilds/linux-{arm,x64,ia32}
84
;;
85
armv7h)
86
rm -rf usb/prebuilds/linux-{arm64,x64,ia32,arm/node.napi.armv6.node}
87
;;
88
esac
89
}
90
package() {
91
cd "${_pkgname}-${pkgver}"
92
93
_appdir="${pkgdir}/usr/lib/${pkgname}"
94
install -d "${_appdir}"
95
96
cp -a out/balenaEtcher-linux-*/resources/* "${_appdir}"
97
cp -a out/sidecar/src "${_appdir}/utils"
98
99
install -Dm755 ${srcdir}/${pkgname} "${pkgdir}/usr/bin/${pkgname}"
100
install -Dm755 ${srcdir}/etcher-util "${_appdir}"
101
install -Dm644 "${srcdir}/${pkgname}.desktop" \
102
"${pkgdir}/usr/share/applications/${pkgname}.desktop"
103
104
for size in 16x16 32x32 48x48 128x128 256x256 512x512; do
105
install -Dm644 "assets/iconset/${size}.png" \
106
"${pkgdir}/usr/share/icons/hicolor/${size}/apps/${pkgname}.png"
107
done
108
__clean_modules
109
}
110
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |