celemod

maintainer TheSw1m · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package builds from the project's own official GitHub source with verified checksums; pnpm install uses --frozen-lockfile against the project's own lockfile, which is normal for a Tauri/Node build, not an undeclared external package install. The only mild concerns are the few-votes/new status and reliance on nightly Rust toolchain fetched at build time, but no obfuscation, exfiltration, or unverifiable prebuilt binaries are present.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The package builds from the project's own official GitHub source with verified checksums; pnpm install uses --frozen-lockfile against the project's own lockfile, which is normal for a Tauri/Node build, not an undeclared external package install. The only mild concerns are the few-votes/new status and reliance on nightly Rust toolchain fetched at build time, but no obfuscation, exfiltration, or unverifiable prebuilt binaries are present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:50 pnpm install --dir src/celemod-ui --frozen-lockfile

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dilant <dilant@qq.com>
    
      2
    
      3pkgname=celemod
    
      4pkgver=1.1.9
    
      5pkgrel=1
    
      6pkgdesc="An alternative mod manager for Celeste"
    
      7arch=('x86_64')
    
      8url="https://github.com/std-microblock/CeleMod"
    
      9license=('GPL-3.0-or-later')
    
      10depends=(
    
      11  'gcc-libs'
    
      12  'glib2'
    
      13  'gtk3'
    
      14  'libsoup3'
    
      15  'webkit2gtk-4.1'
    
      16)
    
      17makedepends=(
    
      18  'cargo-nightly'
    
      19  'cmake'
    
      20  'nodejs>=20'
    
      21  'pnpm'
    
      22  'rust-nightly'
    
      23)
    
      24provides=('cele-mod')
    
      25options=('!lto')
    
      26
    
      27source=(
    
      28  "$pkgname-$pkgver.tar.gz::https://github.com/std-microblock/CeleMod/archive/refs/tags/v$pkgver.tar.gz"
    
      29  'CeleMod.desktop'
    
      30  'disable-self-update.patch'
    
      31)
    
      32sha256sums=(
    
      33  '85c16bc87bdcd7cdab4789f2bc0b375c03199f7786de0f078d4e54915a75c5b7'
    
      34  '683c5ab3017cb560d715576e0eb0342833f22b52ad17d9594499dfd2a7655c42'
    
      35  '9e15105a6ba14a14b6e766689662841195096d2b2ae9bad3568520d69f689778'
    
      36)
    
      37
    
      38prepare() {
    
      39  cd "$srcdir/CeleMod-$pkgver"
    
      40  export RUSTUP_TOOLCHAIN=nightly
    
      41  rustup toolchain install nightly --profile minimal
    
      42  patch -p1 -i "$srcdir/disable-self-update.patch"
    
      43  cargo fetch --locked --target x86_64-unknown-linux-gnu
    
      44}
    
      45
    
      46build() {
    
      47  cd "$srcdir/CeleMod-$pkgver"
    
      48  export RUSTUP_TOOLCHAIN=nightly
    
      49  export CMAKE_POLICY_VERSION_MINIMUM=3.5
    
      50  pnpm install --dir src/celemod-ui --frozen-lockfile
    
      51  pnpm --dir src/celemod-ui tauri build --bundles deb
    
      52}
    
      53
    
      54package() {
    
      55  local debdir
    
      56  debdir="$(echo "$srcdir/CeleMod-$pkgver/target/release/bundle/deb"/*/data)"
    
      57  install -Dm755 "$srcdir/CeleMod-$pkgver/target/release/cele-mod" \
    
      58    "$pkgdir/usr/bin/cele-mod"
    
      59  install -Dm644 "$srcdir/CeleMod.desktop" \
    
      60    "$pkgdir/usr/share/applications/CeleMod.desktop"
    
      61  install -Dm644 "$debdir/usr/share/icons/hicolor/128x128/apps/cele-mod.png" \
    
      62    "$pkgdir/usr/share/icons/hicolor/128x128/apps/cele-mod.png"
    
      63  install -Dm644 "$srcdir/CeleMod-$pkgver/LICENSE" \
    
      64    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      65}
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 11:34:30	LOW	3
2026-08-16 11:32:23	MEDIUM	2