beekeeper-studio-git

maintainer zxp19821005 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged pattern involves yarn installing dependencies during build, but this is part of building the project from its own source (git repo), which is standard for AUR packages; no untrusted prebuilt binaries or remote code execution are involved.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves yarn installing dependencies during build, but this is part of building the project from its own source (git repo), which is standard for AUR packages; no untrusted prebuilt binaries or remote code execution are involved.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:97 NODE_ENV=development yarn add -W -D node-gyp

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=beekeeper-studio-git
    
      3_pkgname="Beekeeper Studio"
    
      4pkgver=5.9.0.beta.4.r11.ga534386
    
      5_electronversion=39
    
      6_nodeversion=22
    
      7pkgrel=1
    
      8pkgdesc="Modern and easy to use SQL client for MySQL, Postgres, SQLite, SQL Server, and more.(Use system-wide electron)"
    
      9arch=('any')
    
      10url="https://www.beekeeperstudio.io/"
    
      11_ghurl="https://github.com/beekeeper-studio/beekeeper-studio"
    
      12license=('GPL-3.0-only')
    
      13depends=(
    
  "electron${_electronversion}"
    
  'nodejs'
    
  'unixodbc'
    
      17)
    
      18makedepends=(
    
  'npm'
    
  'yarn'
    
  'git'
    
  'nvm'
    
  'gendesk'
    
  'jq'
    
  'python'
    
  'ruby'
    
      27)
    
      28source=(
    
  "${pkgname%-git}.git::git+${_ghurl}.git"
    
  "${pkgname%-git}.sh"
    
      31)
    
      32sha256sums=('SKIP'
    
          'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      34pkgver() {
    
  cd "${srcdir}/${pkgname%-git}.git"
    
  set -o pipefail
    
  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g;s/test//g' ||
    
  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      39}
    
      40_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      45}
    
      46_set_build_env() {
    
  export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
    
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
export HOME="${srcdir}/.electron-gyp"
    
mkdir -p "${srcdir}/.electron-gyp"
    
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
{
    
	export YARN_REGISTRY="https://registry.npmmirror.com"
    
	export ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
    
	export ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
    
	export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
    
	export YARN_CACHE_FOLDER="${srcdir}/.yarn/cache"
    
	export YARN_PLUGINS_FOLDER="${srcdir}/.yarn/plugins"
    
	export YARN_GLOBAL_FOLDER="${srcdir}/.yarn/global"
    
	export YARN_USE_HARDLINKS=true
    
	# export YARN_BUILD_FROM_SOURCE=true
    
	export YARN_LINK_WORKSPACE_PACKAGES=true
    
	export YARN_FETCH_RETRIES=3
    
	export YARN_FETCH_RETRY_TIMEOUT=10000
    
	export YARN_NETWORK_CONCURRENCY=32
    
}
    
find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g" {} +
    
fi
    
      70}
    
      71_get_app_dir() {
    
  find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      73}
    
      74_get_electron_version() {
    
  _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
    
      -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
    
  [[ -z "${_elec_ver}" ]] && return 1
    
  echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
    
      79}
    
      80prepare() {
    
  cd "${srcdir}/${pkgname%-git}.git"
    
  _get_electron_version
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname%-git}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${_pkgname}/g
    
  " "${srcdir}/${pkgname%-git}.sh"
    
  gendesk -q -f -n \
    
      --pkgname="${pkgname%-git}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="Utility" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname%-git} %U"
    
  _set_build_env
    
  _ensure_local_nvm
    
  NODE_ENV=development    yarn add -W -D node-gyp
    
  NODE_ENV=development    yarn install --cache-folder "${srcdir}/.yarn_cache"
    
  cd "${srcdir}/${pkgname%-git}.git/apps/studio"
    
  find ./ -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
    
      101}
    
      102build() {
    
  cd "${srcdir}/${pkgname%-git}.git/"
    
  _set_build_env
    
  _ensure_local_nvm
    
  NODE_ENV=production     yarn run lib:build
    
  cd "${srcdir}/${pkgname%-git}.git/apps/studio"
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  NODE_ENV=production     yarn run build
    
  NODE_ENV=production     yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder-config.js
    
      111}
    
      112package() {
    
  install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
    
  local _app_dir=$(_get_app_dir)
    
  cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
    
  icon_sizes=(16x16 24x24 32x32 48x48 64x64 96x96 128x128 256x256 512x512 1024x1024)
    
  for _icons in "${icon_sizes[@]}";do
    
      install -Dm644 "${srcdir}/${pkgname%-git}.git/apps/studio/public/icons/png/${_icons}.png" \
    
          "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
    
  done
    
  install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${pkgname%-git}.git/apps/studio/default.config.ini" -t "${pkgdir}/usr/lib/${pkgname%-git}"
    
  install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE.md" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      125}
    
      126

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2