beekeeper-studio-git

MEDIUM
maintainer zxp19821005 1 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The PKGBUILD installs a version-pinned Yarn CLI from npm via 'npm install -g @yarnpkg/cli-dist' using a dynamically extracted version, which is an unverifiable remote code execution risk if the npm registry is compromised or spoofed.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:142 yarn add -W -D node-gyp
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD installs a version-pinned Yarn CLI from npm via 'npm install -g @yarnpkg/cli-dist' using a dynamically extracted version, which is an unverifiable remote code execution risk if the npm registry is compromised or spoofed.

  • PKGBUILD:100 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=beekeeper-studio-git
3_pkgname="Beekeeper Studio"
4pkgver=6.2.0.beta.3.r133.g2aa04ac
5_electronversion=44
6_nodeversion=24
7pkgrel=1
8pkgdesc="Modern and easy to use SQL client for MySQL, Postgres, SQLite, SQL Server, and more."
9arch=('any')
10url="https://www.beekeeperstudio.io/"
11_ghurl="https://github.com/beekeeper-studio/beekeeper-studio"
12license=('GPL-3.0-only')
13depends=(
14 "electron${_electronversion}"
15 'nodejs'
16 'unixodbc'
17)
18makedepends=(
19 'npm'
20 'yarn'
21 'git'
22 'nvm'
23 'gendesk'
24 'jq'
25 'python'
26 'ruby'
27)
28source=(
29 "${pkgname%-git}.git::git+${_ghurl}.git"
30 "${pkgname%-git}.js"
31 "${pkgname%-git}.sh"
32)
33sha256sums=('SKIP'
34 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
35 '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
36_get_project_dir() {
37 local d
38 while IFS= read -r d; do
39 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
40 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
41}
42pkgver() {
43 cd "$(_get_project_dir)"
44 set -o pipefail
45 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
46 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
47}
48_ensure_local_nvm() {
49 local NVM_DIR="${srcdir}/.nvm"
50 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
51 nvm install "${_nodeversion}"
52 nvm use "${_nodeversion}"
53}
54_get_app_dir() {
55 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
56 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
57}
58_get_electron_version() {
59 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
60 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
61 | grep -oE '[0-9]+' | head -1)
62 [[ -z "${_elec_ver}" ]] && return 1
63 (( _elec_ver == _electronversion )) && c=32 || c=31
64 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
65}
66_set_build_env() {
67 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
68 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
69 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
70 export ELECTRON_BUILDER_OFFLINE=true
71 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
72 export HOME="${srcdir}/.home"
73 export XDG_CACHE_HOME="${HOME}/.cache"
74 export XDG_CONFIG_HOME="${HOME}/.config"
75 export XDG_DATA_HOME="${HOME}/.local/share"
76 export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
77 export YARN_NETWORK_CONCURRENCY=32
78 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
79 export COREPACK_HOME="${HOME}/.corepack"
80 export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
81 local _yarnver _yarnmajor=0
82 _yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"
83 _yarnmajor="${_yarnver%%.*}"
84 _yarnmajor="${_yarnmajor:-0}"
85 if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
86 export XDG_STATE_HOME="${HOME}/.local/state"
87 export YARN_ENABLE_GLOBAL_CACHE=false
88 export YARN_ENABLE_MIRROR=false
89 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
90 export YARN_NODE_LINKER=node-modules
91 export YARN_NM_MODE=hardlinks-local
92 export YARN_ENABLE_TELEMETRY=false
93 export YARN_ENABLE_SCRIPTS=true
94 export YARN_HTTP_TIMEOUT=600000
95 export YARN_HTTP_RETRY=5
96 export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
97 local _yarnhome="${HOME}/.yarn/install"
98 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
99 if [[ -n "${_yarnver}" ]]; then
100 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
101 export PATH="${_yarnhome}/bin:${PATH}"
102 fi
103 else
104 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
105 export YARN_LINK_FOLDER="${HOME}/.yarn/link"
106 export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
107 export YARN_NETWORK_TIMEOUT=600000
108 export YARN_CHILD_CONCURRENCY="$(nproc)"
109 export YARN_FROZEN_LOCKFILE=true
110 export YARN_IGNORE_ENGINES=true
111 export YARN_PRODUCTION=false
112 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
113 fi
114 local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
115 export YARN_REGISTRY="${_reg}"
116 _reg="${_reg%/}"
117 if [[ -f .yarnrc ]]; then
118 sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
119 fi
120 if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
121 sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
122 fi
123}
124prepare() {
125 cd "$(_get_project_dir)"
126 _get_electron_version
127 sed -i -e "
128 s/@electronversion@/${_electronversion}/g
129 s/@appname@/${pkgname%-git}/g
130 " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
131 gendesk -q -f -n \
132 --pkgname="${pkgname%-git}" \
133 --pkgdesc="${pkgdesc}" \
134 --categories="Utility" \
135 --name="${_pkgname}" \
136 --exec="${pkgname%-git} %U"
137 _set_build_env
138 _ensure_local_nvm
139 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
140 find apps/studio -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
141 export NODE_ENV=development
142 yarn add -W -D node-gyp
143 yarn install
144}
145build() {
146 cd "$(_get_project_dir)"
147 _set_build_env
148 _ensure_local_nvm
149 export NODE_ENV=production
150 yarn run lib:build
151 cd "$(_get_project_dir)/apps/studio"
152 yarn run build
153 yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder-config.js
154 local _archrem=$([[ "${CARCH}" == "aarch64" ]] && echo x64 || echo arm)
155 find "$(_get_app_dir)" -type d \
156 \( -name '*darwin*' -o -name '*android*' -o -name 'win32*' -o -name "*ia32*" -o -name "*${_archrem}*" \) \
157 -prune -exec rm -rf {} +
158 rm -rf "$(_get_app_dir)/resources/default_app.asar"
159}
160package() {
161 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
162 install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
163 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
164 icon_sizes=(16x16 24x24 32x32 48x48 64x64 96x96 128x128 256x256 512x512 1024x1024)
165 for _icons in "${icon_sizes[@]}";do
166 install -Dm644 "$(_get_project_dir)/apps/studio/public/icons/png/${_icons}.png" \
167 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
168 done
169 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
170 install -Dm644 "$(_get_project_dir)/apps/studio/default.config.ini" -t "${pkgdir}/usr/lib/${pkgname%-git}"
171 install -Dm644 "$(_get_project_dir)/LICENSE.md" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
172}
173

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=beekeeper-studio-git
_pkgname="Beekeeper Studio"
-pkgver=6.1.5.r107.g92f6f0c
+pkgver=6.2.0.beta.3.r133.g2aa04ac
_electronversion=44
_nodeversion=24
pkgrel=1
@@ -27,10 +27,12 @@
)
source=(
"${pkgname%-git}.git::git+${_ghurl}.git"
+ "${pkgname%-git}.js"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
_get_project_dir() {
local d
while IFS= read -r d; do
@@ -38,16 +40,28 @@
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
}
pkgver() {
- cd "$(_get_project_dir)"
- set -o pipefail
- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g;s/test//g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
+}
+_get_app_dir() {
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
+}
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
@@ -65,7 +79,7 @@
export COREPACK_HOME="${HOME}/.corepack"
export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
local _yarnver _yarnmajor=0
- _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
+ _yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"
_yarnmajor="${_yarnver%%.*}"
_yarnmajor="${_yarnmajor:-0}"
if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
@@ -80,7 +94,12 @@
export YARN_HTTP_TIMEOUT=600000
export YARN_HTTP_RETRY=5
export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
- mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}"
+ local _yarnhome="${HOME}/.yarn/install"
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
+ if [[ -n "${_yarnver}" ]]; then
+ npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
+ export PATH="${_yarnhome}/bin:${PATH}"
+ fi
else
export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
export YARN_LINK_FOLDER="${HOME}/.yarn/link"
@@ -93,6 +112,7 @@
mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
fi
local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
+ export YARN_REGISTRY="${_reg}"
_reg="${_reg%/}"
if [[ -f .yarnrc ]]; then
sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
@@ -101,25 +121,13 @@
sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
fi
}
-_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
-}
-_get_electron_version() {
- _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
- | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
- | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
-}
prepare() {
cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${_pkgname}/g
- " "${srcdir}/${pkgname%-git}.sh"
+ " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
gendesk -q -f -n \
--pkgname="${pkgname%-git}" \
--pkgdesc="${pkgdesc}" \
@@ -143,29 +151,23 @@
cd "$(_get_project_dir)/apps/studio"
yarn run build
yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder-config.js
- local _app_dir="$(_get_app_dir)"
- case "${CARCH}" in
- aarch64) _archrem=x64 ;;
- x86_64) _archrem=arm ;;
- esac
- find "${_app_dir}/resources/app.asar.unpacked" -type d \
- \( -name "darwin*" -o -name "win32*" -o -name "*${_archrem}"* \) \
- -exec rm -rf {} +
+ local _archrem=$([[ "${CARCH}" == "aarch64" ]] && echo x64 || echo arm)
+ find "$(_get_app_dir)" -type d \
+ \( -name '*darwin*' -o -name '*android*' -o -name 'win32*' -o -name "*ia32*" -o -name "*${_archrem}*" \) \
+ -prune -exec rm -rf {} +
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir="$(_get_app_dir)"
- cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
- rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
- local _src="$(_get_project_dir)"
+ install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
icon_sizes=(16x16 24x24 32x32 48x48 64x64 96x96 128x128 256x256 512x512 1024x1024)
for _icons in "${icon_sizes[@]}";do
- install -Dm644 "${_src}/apps/studio/public/icons/png/${_icons}.png" \
+ install -Dm644 "$(_get_project_dir)/apps/studio/public/icons/png/${_icons}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
done
- install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${_src}/apps/studio/default.config.ini" -t "${pkgdir}/usr/lib/${pkgname%-git}"
- install -Dm644 "${_src}/LICENSE.md" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/apps/studio/default.config.ini" -t "${pkgdir}/usr/lib/${pkgname%-git}"
+ install -Dm644 "$(_get_project_dir)/LICENSE.md" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
}

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Medium 2
2026-10-31 00:07:41 Medium 2
2026-10-30 00:29:30 Medium 2
2026-10-29 03:51:44 Medium 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 00:06:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion