bili-live-hime

maintainer bianca · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx commands run Vite and Tauri build tools on the project's own source code, which is downloaded from the official GitHub repository; this is a standard part of building a legitimate Tauri application and poses no remote code execution risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx commands run Vite and Tauri build tools on the project's own source code, which is downloaded from the official GitHub repository; this is a standard part of building a legitimate Tauri application and poses no remote code execution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:56 npx vite build --base ./
PKGBUILD:57 npx tauri build --no-bundle --config '{"build":{"beforeBuildCommand":""}}'

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: bianca <zhaoxiaokee@gmail.com>
    
      2
    
      3pkgname=bili-live-hime
    
      4_upstream=bili-live-hime
    
      5pkgver=0.5.2
    
      6_tag="LiveHime-v${pkgver}"
    
      7pkgrel=1
    
      8pkgdesc="bilibili官方直播姬的轻量化替代工具"
    
      9arch=('x86_64')
    
      10url="https://github.com/Rsplwe/bili-live-hime"
    
      11license=('GPL-2.0-only')
    
      12depends=('webkit2gtk-4.1' 'gtk3' 'libnm' 'libayatana-appindicator' 'openssl')
    
      13makedepends=('nodejs' 'npm' 'rust' 'cargo')
    
      14conflicts=('bili-live-hime-git')
    
      15source=("${_upstream}-${_tag}.tar.gz::https://github.com/Rsplwe/${_upstream}/archive/refs/tags/${_tag}.tar.gz")
    
      16sha256sums=('9652247a9ff68f8f468adaf660591844bbcb4e4a2745b6f0d51b41aff66ac030')
    
      17
    
      18prepare() {
    
      19    cd "${srcdir}/${_upstream}-${_tag}"
    
      20
    
      21    export CARGO_HOME="${srcdir}/cargo-home"
    
      22    export npm_config_cache="${srcdir}/npm-cache"
    
      23
    
      24    sed -i 's/^lto = true$/lto = false/' src-tauri/Cargo.toml
    
      25
    
      26    node <<'EOF_NODE'
    
      27const fs = require('fs');
    
      28const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
    
      29
    
      30delete pkg.overrides;
    
      31
    
      32fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
    
      33EOF_NODE
    
      34
    
      35npm install --legacy-peer-deps
    
      36}
    
      37
    
      38build() {
    
      39    cd "${srcdir}/${_upstream}-${_tag}"
    
      40
    
      41    export CARGO_HOME="${srcdir}/cargo-home"
    
      42    export npm_config_cache="${srcdir}/npm-cache"
    
      43    export NODE_ENV=production
    
      44    export CC=gcc
    
      45    export CXX=g++
    
      46
    
      47    unset CFLAGS CXXFLAGS CPPFLAGS LDFLAGS RUSTFLAGS
    
      48    export RUSTFLAGS='-C linker=gcc'
    
      49
    
      50    local main_css
    
      51    main_css=$(find src -name '*.css' | head -n 1)
    
      52    if [[ -n "${main_css}" ]]; then
    
      53      sed -i '1i @source "./**/*.{ts,tsx,html}";' "${main_css}"
    
      54    fi
    
      55
    
      56    npx vite build --base ./
    
      57    npx tauri build --no-bundle --config '{"build":{"beforeBuildCommand":""}}'
    
      58}
    
      59
    
      60package() {
    
      61    cd "${srcdir}/${_upstream}-${_tag}"
    
      62
    
      63    install -Dm755 "src-tauri/target/release/${_upstream}" "${pkgdir}/usr/bin/${_upstream}"
    
      64    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      65
    
      66    for size in 32 128; do
    
      67      install -Dm644 "src-tauri/icons/${size}x${size}.png" \
    
      68        "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/${_upstream}.png"
    
      69    done
    
      70
    
      71    install -Dm644 "src-tauri/icons/128x128@2x.png" \
    
      72      "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_upstream}.png"
    
      73
    
      74    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${_upstream}.desktop" <<EOF_DESKTOP
    
      75[Desktop Entry]
    
      76Name=Bili Live Hime
    
      77Exec=${_upstream}
    
      78Icon=${_upstream}
    
      79Type=Application
    
      80Categories=AudioVideo;Video;
    
      81Comment=${pkgdesc}
    
      82Terminal=false
    
      83EOF_DESKTOP
    
      84}
    
      85

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2