bili-music

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The PKGBUILD installs and executes remote npm packages (@tauri-apps/cli via npm install and tauri via npx) without declaring them as dependencies, posing a supply-chain risk if the registry or package is compromised.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:83 npm install @tauri-apps/cli@^2
Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:89 npx tauri build
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD installs and executes remote npm packages (@tauri-apps/cli via npm install and tauri via npx) without declaring them as dependencies, posing a supply-chain risk if the registry or package is compromised.

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=bili-music
3_pkgname='Bili Music'
4_zhsname='午夜黑胶'
5pkgver=1.0.0
6_nodeversion=24
7pkgrel=1
8pkgdesc="A no login, no disk B station music player. Use Bilibili as your music library, listen to music without login, do not have to download.一个免登录、不落盘的 B 站音乐播放器。把哔哩哔哩当作你的曲库，听歌不必登录，不必下载。"
9arch=('any')
10url="https://github.com/Jmiao11/bili-music"
11license=('MIT')
12provides=("${pkgname%-git}=${pkgver%.r*}")
13conflicts=("${pkgname%-git}")
14depends=(
15 'gtk3'
16 'gdk-pixbuf2'
17 'webkit2gtk-4.1'
18 'libappindicator'
19)
20makedepends=(
21 'git'
22 'rustup'
23 'gendesk'
24 'librsvg'
25 'npm'
26 'nvm'
27 'jq'
28)
29options=(
30 '!lto'
31)
32source=(
33 "${pkgname}-${pkgver}::git+${url}.git#tag=v${pkgver}"
34)
35sha256sums=('773016238b1ab736fdc3e679c9a2bda135a5647e34b5812e9bfee14321dc8250')
36_get_project_dir() {
37 local d
38 while IFS= read -r d; do
39 find "$d" -name "src-tauri" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
40 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
41}
42_get_app_dir() {
43 find "$(_get_project_dir)" -type d -name "release" -exec test -d "{}/.fingerprint" -a -d "{}/deps" \; -print -quit 2>/dev/null
44}
45_set_build_env() {
46 export HOME="${srcdir}/.home"
47 export CARGO_HOME="${HOME}/.cargo"
48 export CARGO_NET_GIT_FETCH_WITH_CLI=true
49 export CARGO_NET_RETRY=5
50 export CARGO_HTTP_MULTIPLEXING=false
51 export CARGO_INCREMENTAL=0
52 export CARGO_TERM_COLOR=never
53 export CARGO_PROFILE_RELEASE_STRIP=symbols
54 export XDG_CACHE_HOME="${HOME}/.cache"
55 export XDG_CONFIG_HOME="${HOME}/.config"
56 export XDG_DATA_HOME="${HOME}/.local/share"
57 export npm_config_cache="${HOME}/.npm_cache"
58 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
59 export COREPACK_HOME="${HOME}/.corepack"
60 export npm_config_audit=false
61 mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}" "${CARGO_HOME}"
62}
63_ensure_local_nvm() {
64 local NVM_DIR="${srcdir}/.nvm"
65 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
66 nvm install "${_nodeversion}"
67 nvm use "${_nodeversion}"
68}
69prepare() {
70 cd "$(_get_project_dir)"
71 gendesk -q -f -n \
72 --pkgname="${pkgname}" \
73 --pkgdesc="${pkgdesc}" \
74 --categories="AudioVideo" \
75 --name="${_pkgname}" \
76 --custom=Name[zh_CN]="${_zhsname}" \
77 --exec="${pkgname} %U"
78 _ensure_local_nvm
79 _set_build_env
80 jq '.bundle.active = false' src-tauri/tauri.conf.json > tmp.json && mv tmp.json src-tauri/tauri.conf.json
81 rustup update stable
82 rustup default stable
83 npm install @tauri-apps/cli@^2
84}
85build() {
86 cd "$(_get_project_dir)"
87 _ensure_local_nvm
88 _set_build_env
89 npx tauri build
90}
91package() {
92 install -Dm755 "$(_get_app_dir)/"{"${pkgname}",guest_playurl_verify} -t "${pkgdir}/usr/bin"
93 install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
94 install -Dm644 "$(_get_project_dir)/design/app-icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
95 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
96}
97

Changes since previous scan

--- PKGBUILD @ 2026-10-26 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,7 +2,7 @@
pkgname=bili-music
_pkgname='Bili Music'
_zhsname='午夜黑胶'
-pkgver=0.8.0
+pkgver=1.0.0
_nodeversion=24
pkgrel=1
pkgdesc="A no login, no disk B station music player. Use Bilibili as your music library, listen to music without login, do not have to download.一个免登录、不落盘的 B 站音乐播放器。把哔哩哔哩当作你的曲库，听歌不必登录，不必下载。"
@@ -19,12 +19,12 @@
)
makedepends=(
'git'
- 'curl'
'rustup'
'gendesk'
'librsvg'
'npm'
'nvm'
+ 'jq'
)
options=(
'!lto'
@@ -32,12 +32,15 @@
source=(
"${pkgname}-${pkgver}::git+${url}.git#tag=v${pkgver}"
)
-sha256sums=('b7d14db1110a9e26af6646875c574b4cd01e131006ab914a9e2706308b3f5229')
+sha256sums=('773016238b1ab736fdc3e679c9a2bda135a5647e34b5812e9bfee14321dc8250')
_get_project_dir() {
local d
while IFS= read -r d; do
find "$d" -name "src-tauri" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
+_get_app_dir() {
+ find "$(_get_project_dir)" -type d -name "release" -exec test -d "{}/.fingerprint" -a -d "{}/deps" \; -print -quit 2>/dev/null
}
_set_build_env() {
export HOME="${srcdir}/.home"
@@ -74,6 +77,7 @@
--exec="${pkgname} %U"
_ensure_local_nvm
_set_build_env
+ jq '.bundle.active = false' src-tauri/tauri.conf.json > tmp.json && mv tmp.json src-tauri/tauri.conf.json
rustup update stable
rustup default stable
npm install @tauri-apps/cli@^2
@@ -85,9 +89,9 @@
npx tauri build
}
package() {
- local _app_dir="$(_get_project_dir)"
- install -Dm755 "${_app_dir}/target/release/"{"${pkgname}",guest_playurl_verify} -t "${pkgdir}/usr/bin"
- install -Dm644 "${_app_dir}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${_app_dir}/design/app-icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
- install -Dm644 "${_app_dir}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm755 "$(_get_app_dir)/"{"${pkgname}",guest_playurl_verify} -t "${pkgdir}/usr/bin"
+ install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/design/app-icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Medium 3
2026-10-31 00:07:41 Medium 3
2026-10-30 00:29:30 Medium 3
2026-10-29 00:13:55 Medium 3
2026-10-28 00:06:54 Medium 3
2026-10-27 00:23:28 Medium 3
2026-10-26 23:46:04 Medium 3
2026-10-26 00:12:40 Medium 3
2026-10-25 00:20:48 Medium 3
2026-10-24 00:14:55 Medium 3
2026-10-23 00:02:19 Medium 3
2026-10-22 00:13:10 Medium 3
2026-10-21 00:12:50 Medium 3
2026-10-20 00:10:31 Medium 3
2026-10-19 00:03:55 Medium 3
2026-10-18 00:06:55 Medium 3
2026-10-17 00:21:55 Medium 3
2026-10-16 00:12:47 Medium 3
2026-10-15 00:28:05 Medium 3
2026-10-14 00:06:47 Medium 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion