boxplayer-bin

MEDIUM

maintainer zxp19821005 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The PKGBUILD runs 'npm install' on external packages (aria2-lib, @motrix/nat-api) during prepare(), which are not declared in source[] or dependencies, posing a supply-chain risk if those packages are compromised.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:64 npm install aria2-lib @motrix/nat-api --save

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The PKGBUILD runs 'npm install' on external packages (aria2-lib, @motrix/nat-api) during prepare(), which are not declared in source[] or dependencies, posing a supply-chain risk if those packages are compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=boxplayer-bin
    
      3_pkgname=BoxPlayer
    
      4pkgver=5.0.37
    
      5_electronversion=40
    
      6pkgrel=1
    
      7pkgdesc="Unified cloud drive management, smart media library, media servers, and high-speed downloads.多网盘文件管理、媒体库、媒体服务器、AI Agent、音乐播放器和电子书阅读器，放在同一个跨平台桌面App里."
    
      8arch=(
    
      9    'aarch64'
    
      10    'x86_64'
    
      11)
    
      12url="https://www.xbyvideohub.com/"
    
      13_ghurl="https://github.com/gaozhangmin/boxplayer"
    
      14license=('GPL-3.0-only')
    
      15conflicts=("${pkgname%-bin}")
    
      16provides=("${pkgname%-bin}=${pkgver}")
    
      17depends=(
    
      18    "electron${_electronversion}"
    
      19    'nodejs'
    
      20)
    
      21makedepends=(
    
      22    'asar'
    
      23    'npm'
    
      24)
    
      25options=(
    
      26    '!emptydirs'
    
      27)
    
      28source=("${pkgname%-bin}.sh")
    
      29source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.AppImage::${_ghurl}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-linux-arm64.AppImage")
    
      30source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.AppImage::${_ghurl}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-linux-x86_64.AppImage")
    
      31sha256sums=('dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
    
      32sha256sums_aarch64=('953b7b6b88064e3c37b0e8a4d83bf740a650171ad3c6161d80622b0012933803')
    
      33sha256sums_x86_64=('4aa72616e1fc7ae3a743c2f667e4cd21b203c021d078493306c9b40fb7c4a5f3')
    
      34_get_app_dir() {
    
      35	find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
    
      36		| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
    
      37}
    
      38_check_electron_version() {
    
      39	local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
    
      40		-executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)" \
    
      41		| grep -oP 'Electron/\K[0-9]+' | head -1)
    
      42	[[ -z "$_v" ]] && { echo -e "\033[1;33mNote: Could not check version.\033[0m"; return; }
    
      43	(( _v == _electronversion )) && c=32 || c=31
    
      44	echo -e "Electron version: \033[1;${c}m$_v$([[ $c -eq 31 ]] && echo " (expected $_electronversion)")\033[0m"
    
      45}
    
      46prepare() {
    
      47    sed -i -e "
    
      48        s/@electronversion@/${_electronversion}/g
    
      49        s/@appname@/${pkgname%-bin}/g
    
      50    " "${srcdir}/${pkgname%-bin}.sh"
    
      51    if [ ! -x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" ];then
    
      52        chmod +x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage"
    
      53    fi
    
      54    if [ -d "${srcdir}/squashfs-root" ];then
    
      55        rm -rf "${srcdir}/squashfs-root"
    
      56    fi
    
      57    "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" --appimage-extract > /dev/null
    
      58    _check_electron_version
    
      59    sed -i "s/AppRun --no-sandbox/${pkgname%-bin}/g" "$(_get_app_dir)/${pkgname%-bin}.desktop"
    
      60    asar e "$(_get_app_dir)/resources/app.asar" "${srcdir}/app.asar.unpacked"
    
      61    cd "${srcdir}/app.asar.unpacked"
    
      62    sed -i '/"packageManager"/d' package.json
    
      63    npm config set allow-remote all
    
      64    npm install aria2-lib @motrix/nat-api --save
    
      65    cd - > /dev/null
    
      66    find "${srcdir}/app.asar.unpacked/dist" -type f \
    
      67        -exec sed -i -e "
    
      68            s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g
    
      69            s/process.execPath/\'\/usr\/lib\/${pkgname%-bin}\'/g\
    
      70            " {} +
    
      71    asar p "${srcdir}/app.asar.unpacked" "$(_get_app_dir)/resources/app.asar"
    
      72    find "$(_get_app_dir)/resources" -type d -perm 700 -exec chmod 755 {} +
    
      73    find "$(_get_app_dir)/resources" -type f -name "*.so.*" -perm 777 -exec chmod 644 {} +
    
      74}
    
      75package() {
    
      76    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      77    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      78	cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      79    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
    
      80		_extension="${_i##*.}"
    
      81		_icon_path="${_i#*share/icons/}"
    
      82		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
    
      83		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
    
      84	done
    
      85    install -Dm644 "$(_get_app_dir)/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      86}
    
      87

Changes since previous scan

--- PKGBUILD @ 2026-10-20 00:10
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
 pkgname=boxplayer-bin
 _pkgname=BoxPlayer
-pkgver=5.0.36
+pkgver=5.0.37
 _electronversion=40
 pkgrel=1
 pkgdesc="Unified cloud drive management, smart media library, media servers, and high-speed downloads.多网盘文件管理、媒体库、媒体服务器、AI Agent、音乐播放器和电子书阅读器，放在同一个跨平台桌面App里."
@@ -28,11 +28,12 @@
 source=("${pkgname%-bin}.sh")
 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.AppImage::${_ghurl}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-linux-arm64.AppImage")
 source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.AppImage::${_ghurl}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-linux-x86_64.AppImage")
-sha256sums=('cebedc3391cbab6d43f37fbf3a87ddaad16597cb5ea487a4d55b1f478d810082')
-sha256sums_aarch64=('4bce0ccb4c733c0fab69404731111965ac2e1fdcd017d4b0d321d9fbe6d9f0b7')
-sha256sums_x86_64=('e0aacd812b9e652bdf55b2935756b1f496788beb6d6d3f43f3177da31ffcad79')
+sha256sums=('dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
+sha256sums_aarch64=('953b7b6b88064e3c37b0e8a4d83bf740a650171ad3c6161d80622b0012933803')
+sha256sums_x86_64=('4aa72616e1fc7ae3a743c2f667e4cd21b203c021d078493306c9b40fb7c4a5f3')
 _get_app_dir() {
-	find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
+	find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+		| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
 }
 _check_electron_version() {
 	local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
@@ -46,7 +47,6 @@
     sed -i -e "
         s/@electronversion@/${_electronversion}/g
         s/@appname@/${pkgname%-bin}/g
-        s/@runname@/app.asar/g
     " "${srcdir}/${pkgname%-bin}.sh"
     if [ ! -x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" ];then
         chmod +x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage"
@@ -56,9 +56,8 @@
     fi
     "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" --appimage-extract > /dev/null
     _check_electron_version
-    local _app_dir="$(_get_app_dir)"
-    sed -i "s/AppRun --no-sandbox/${pkgname%-bin}/g" "${_app_dir}/${pkgname%-bin}.desktop"
-    asar e "${_app_dir}/resources/app.asar" "${srcdir}/app.asar.unpacked"
+    sed -i "s/AppRun --no-sandbox/${pkgname%-bin}/g" "$(_get_app_dir)/${pkgname%-bin}.desktop"
+    asar e "$(_get_app_dir)/resources/app.asar" "${srcdir}/app.asar.unpacked"
     cd "${srcdir}/app.asar.unpacked"
     sed -i '/"packageManager"/d' package.json
     npm config set allow-remote all
@@ -69,21 +68,20 @@
             s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g
             s/process.execPath/\'\/usr\/lib\/${pkgname%-bin}\'/g\
             " {} +
-    asar p "${srcdir}/app.asar.unpacked" "${_app_dir}/resources/app.asar"
-    find "${_app_dir}/resources" -type d -perm 700 -exec chmod 755 {} +
-    find "${_app_dir}/resources" -type f -name "*.so.*" -perm 777 -exec chmod 644 {} +
+    asar p "${srcdir}/app.asar.unpacked" "$(_get_app_dir)/resources/app.asar"
+    find "$(_get_app_dir)/resources" -type d -perm 700 -exec chmod 755 {} +
+    find "$(_get_app_dir)/resources" -type f -name "*.so.*" -perm 777 -exec chmod 644 {} +
 }
 package() {
     install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
     install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
-	local _app_dir="$(_get_app_dir)"
-	cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
+	cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
     find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
 		_extension="${_i##*.}"
 		_icon_path="${_i#*share/icons/}"
 		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
 		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
 	done
-    install -Dm644 "${_app_dir}/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
+    install -Dm644 "$(_get_app_dir)/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 03:27:25	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2