beyondallreason-git

LOW

maintainer tiziodcaio 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx command runs electron-builder on the locally prepared project source, which is part of the build process for an Electron app and does not execute arbitrary remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx command runs electron-builder on the locally prepared project source, which is part of the build process for an Electron app and does not execute arbitrary remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:71 npx electron-builder -- -c.electronDist=$electronDist -c.electronVersion=$electronVer --linux --dir

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dbas.so <d dot bass05 at proton dot me>
    
      2pkgname=beyondallreason-git
    
      3electronver=42
    
      4pkgver=r4620.e0217bd
    
      5electronver=42
    
      6pkgrel=1
    
      7pkgdesc="The latest release of BYAR-Chobby, the launcher for Beyond All Reason - An open source RTS game built on top of the Spring RTS Engine"
    
      8arch=(x86_64)
    
      9url="https://beyondallreason.info"
    
      10license=('GPL-2.0-or-later' 'CC-BY-SA-4.0' 'CC-BY-NC-ND-4.0')
    
      11depends=(electron${electronver} gtk3 sdl2 zlib bash)
    
      12makedepends=(nodejs git jq npm)
    
      13conflicts=(beyondallreason-appimage)
    
      14source=("git+https://github.com/beyond-all-reason/BYAR-Chobby.git"
    
      15  "git+https://github.com/beyond-all-reason/spring-launcher.git"
    
      16  "run.sh" "beyondallreason.desktop")
    
      17
    
      18provides=(beyondallreason)
    
      19conflicts=(beyondallreason)
    
      20
    
      21b2sums=('SKIP'
    
      22        'SKIP'
    
      23        '2b38725afa65f4e54606df379fa0184345611c76336c205db2fd1c5ab8f6fe42e10c8a002599325f790207f52de0ba9bd5022f813d7a436f6b2378af9d33d638'
    
      24        '29bad1442d12fe970722e2d4ab6f4daea47b8d3014b1d4dc11eab5b790329c434f7b109a21a396138313a10cd36821f9c711515ed4666466c71e7f0b90ff65c5')
    
      25
    
      26pkgver() {
    
      27  cd "BYAR-Chobby"
    
      28
    
      29  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      30}
    
      31
    
      32prepare() {
    
      33  cd "BYAR-Chobby"
    
      34
    
      35  mkdir -p $srcdir/app/chobby $srcdir/src
    
      36
    
      37  export PACKAGE_VERSION=$(echo "1.$(git rev-list --count HEAD).0")
    
      38  export GITHUB_REPOSITORY="beyond-all-reason/BYAR-Chobby"
    
      39
    
      40  cp -r dist_cfg $srcdir/app/chobby
    
      41  cp -r build $srcdir/app/chobby
    
      42
    
      43  cd "../spring-launcher"
    
      44
    
      45  cp -r $srcdir/app/chobby/dist_cfg/* $srcdir/src/
    
      46  for dir in bin files build; do
    
      47          mkdir -p $dir
    
      48          if [ -d $srcdir/src/$dir/ ]; then
    
      49            mv $srcdir/src/$dir/* $dir/
    
      50            rm -rf $srcdir/src/$dir
    
      51          fi
    
      52        done
    
      53
    
      54  echo "Making build for version: $PACKAGE_VERSION"
    
      55  node $srcdir/app/chobby/build/make_package_json.js package.json $srcdir/app/chobby/dist_cfg/config.json $GITHUB_REPOSITORY $PACKAGE_VERSION
    
      56
    
      57  jq '.build.linux.target="dir"' <<<$(<package.json) > package.json
    
      58  cat package.json
    
      59
    
      60  npm ci --ignore-scripts --allow-git=all
    
      61
    
      62  sed -i 's|\${process\.resourcesPath}/\.\.||g' src/spring_platform.js
    
      63}
    
      64
    
      65build() {
    
      66  cd "spring-launcher"
    
      67
    
      68  electronDist="/usr/lib/electron${electronver}"
    
      69  electronVersion=$(<"${electronDist}/version")
    
      70
    
      71  npx electron-builder -- -c.electronDist=$electronDist -c.electronVersion=$electronVer --linux --dir
    
      72}
    
      73
    
      74package() {
    
      75  cd "./spring-launcher"
    
      76
    
      77  mkdir -p $pkgdir/usr/{bin,share/beyondallreason}
    
      78
    
      79  cp -a dist/linux*unpacked/resources/** $pkgdir/usr/share/beyondallreason
    
      80
    
      81  rm -r $pkgdir/usr/share/beyondallreason/app.asar.unpacked/node_modules/7zip-bin/linux/arm*
    
      82
    
      83  install -Dm644 $srcdir/app/chobby/dist_cfg/config.json $pkgdir/usr/share/beyondallreason
    
      84
    
      85  install -Dm755 $srcdir/run.sh $pkgdir/usr/bin/beyondallreason
    
      86  install -Dm755 dist/linux*unpacked/bin/pr-downloader $pkgdir/usr/bin/
    
      87  
    
      88  install -Dm644 $srcdir/app/chobby/dist_cfg/build/icon.png $pkgdir/usr/share/icons/hicolor/128x128/apps/beyondallreason.png
    
      89  install -Dm644 $srcdir/beyondallreason.desktop $pkgdir/usr/share/applications/beyondallreason.desktop
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2