beekeeper-studio-git

LOW
maintainer zxp19821005 1 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The flagged pattern involves yarn installing dependencies during build, but this is part of building the project from its own source (git repo), which is standard for AUR packages; no untrusted prebuilt binaries or remote code execution are involved.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves yarn installing dependencies during build, but this is part of building the project from its own source (git repo), which is standard for AUR packages; no untrusted prebuilt binaries or remote code execution are involved.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:97 NODE_ENV=development yarn add -W -D node-gyp

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=beekeeper-studio-git
3_pkgname="Beekeeper Studio"
4pkgver=5.9.0.beta.4.r11.ga534386
5_electronversion=39
6_nodeversion=22
7pkgrel=1
8pkgdesc="Modern and easy to use SQL client for MySQL, Postgres, SQLite, SQL Server, and more.(Use system-wide electron)"
9arch=('any')
10url="https://www.beekeeperstudio.io/"
11_ghurl="https://github.com/beekeeper-studio/beekeeper-studio"
12license=('GPL-3.0-only')
13depends=(
14 "electron${_electronversion}"
15 'nodejs'
16 'unixodbc'
17)
18makedepends=(
19 'npm'
20 'yarn'
21 'git'
22 'nvm'
23 'gendesk'
24 'jq'
25 'python'
26 'ruby'
27)
28source=(
29 "${pkgname%-git}.git::git+${_ghurl}.git"
30 "${pkgname%-git}.sh"
31)
32sha256sums=('SKIP'
33 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
34pkgver() {
35 cd "${srcdir}/${pkgname%-git}.git"
36 set -o pipefail
37 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g;s/test//g' ||
38 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
39}
40_ensure_local_nvm() {
41 local NVM_DIR="${srcdir}/.nvm"
42 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
43 nvm install "${_nodeversion}"
44 nvm use "${_nodeversion}"
45}
46_set_build_env() {
47 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
48 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
49 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
50 export HOME="${srcdir}/.electron-gyp"
51 mkdir -p "${srcdir}/.electron-gyp"
52 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
53 {
54 export YARN_REGISTRY="https://registry.npmmirror.com"
55 export ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
56 export ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
57 export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
58 export YARN_CACHE_FOLDER="${srcdir}/.yarn/cache"
59 export YARN_PLUGINS_FOLDER="${srcdir}/.yarn/plugins"
60 export YARN_GLOBAL_FOLDER="${srcdir}/.yarn/global"
61 export YARN_USE_HARDLINKS=true
62 # export YARN_BUILD_FROM_SOURCE=true
63 export YARN_LINK_WORKSPACE_PACKAGES=true
64 export YARN_FETCH_RETRIES=3
65 export YARN_FETCH_RETRY_TIMEOUT=10000
66 export YARN_NETWORK_CONCURRENCY=32
67 }
68 find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g" {} +
69 fi
70}
71_get_app_dir() {
72 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
73}
74_get_electron_version() {
75 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
76 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
77 [[ -z "${_elec_ver}" ]] && return 1
78 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
79}
80prepare() {
81 cd "${srcdir}/${pkgname%-git}.git"
82 _get_electron_version
83 sed -i -e "
84 s/@electronversion@/${_electronversion}/g
85 s/@appname@/${pkgname%-git}/g
86 s/@runname@/app.asar/g
87 s/@cfgdirname@/${_pkgname}/g
88 " "${srcdir}/${pkgname%-git}.sh"
89 gendesk -q -f -n \
90 --pkgname="${pkgname%-git}" \
91 --pkgdesc="${pkgdesc}" \
92 --categories="Utility" \
93 --name="${_pkgname}" \
94 --exec="${pkgname%-git} %U"
95 _set_build_env
96 _ensure_local_nvm
97 NODE_ENV=development yarn add -W -D node-gyp
98 NODE_ENV=development yarn install --cache-folder "${srcdir}/.yarn_cache"
99 cd "${srcdir}/${pkgname%-git}.git/apps/studio"
100 find ./ -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
101}
102build() {
103 cd "${srcdir}/${pkgname%-git}.git/"
104 _set_build_env
105 _ensure_local_nvm
106 NODE_ENV=production yarn run lib:build
107 cd "${srcdir}/${pkgname%-git}.git/apps/studio"
108 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
109 NODE_ENV=production yarn run build
110 NODE_ENV=production yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder-config.js
111}
112package() {
113 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
114 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
115 local _app_dir=$(_get_app_dir)
116 cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
117 icon_sizes=(16x16 24x24 32x32 48x48 64x64 96x96 128x128 256x256 512x512 1024x1024)
118 for _icons in "${icon_sizes[@]}";do
119 install -Dm644 "${srcdir}/${pkgname%-git}.git/apps/studio/public/icons/png/${_icons}.png" \
120 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
121 done
122 install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
123 install -Dm644 "${srcdir}/${pkgname%-git}.git/apps/studio/default.config.ini" -t "${pkgdir}/usr/lib/${pkgname%-git}"
124 install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE.md" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
125}
126

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion