celemod

LOW

maintainer TheSw1m 0 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The pnpm install runs on the project's own source (src/celemod-ui) from the verified GitHub tarball, which is a normal build step for a Tauri app, not an undeclared external package install.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pnpm install runs on the project's own source (src/celemod-ui) from the verified GitHub tarball, which is a normal build step for a Tauri app, not an undeclared external package install.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:42 pnpm install --dir src/celemod-ui --frozen-lockfile

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: TheSw1m <swim853279614@163.com>
    
      2# Contributor: Dilant <dilant@qq.com>
    
      3
    
      4pkgname=celemod
    
      5pkgver=1.2.1
    
      6pkgrel=1
    
      7pkgdesc="An alternative mod manager for Celeste"
    
      8arch=('x86_64')
    
      9url="https://github.com/std-microblock/CeleMod"
    
      10license=('GPL-3.0-or-later')
    
      11depends=(
    
      12  'gcc-libs'
    
      13  'glib2'
    
      14  'gtk3'
    
      15  'libsoup3'
    
      16  'webkit2gtk-4.1'
    
      17)
    
      18makedepends=(
    
      19  'cargo-nightly'
    
      20  'cmake'
    
      21  'nodejs>=20'
    
      22  'pnpm'
    
      23)
    
      24
    
      25provides=('cele-mod')
    
      26options=('!lto')
    
      27
    
      28source=(
    
      29  "$pkgname-$pkgver.tar.gz::https://github.com/std-microblock/CeleMod/archive/refs/tags/v$pkgver.tar.gz"
    
      30  'CeleMod.desktop'
    
      31  'disable-self-update.patch'
    
      32)
    
      33sha256sums=('dfc9ea2c535fba508b22ed5404e86e4bb44a4e7273aa2b11158fd3124380e4bf'
    
      34            '683c5ab3017cb560d715576e0eb0342833f22b52ad17d9594499dfd2a7655c42'
    
      35            '808ef279cf059a2fcdf25dd4b040a41866670aa27161b1d532ff67fc65cef303')
    
      36
    
      37prepare() {
    
      38  cd "$srcdir/CeleMod-$pkgver"
    
      39  export RUSTUP_TOOLCHAIN=nightly
    
      40  patch -p1 -i "$srcdir/disable-self-update.patch"
    
      41  cargo fetch --locked --target x86_64-unknown-linux-gnu
    
      42  pnpm install --dir src/celemod-ui --frozen-lockfile
    
      43}
    
      44
    
      45build() {
    
      46  cd "$srcdir/CeleMod-$pkgver"
    
      47  export RUSTUP_TOOLCHAIN=nightly
    
      48  export CARGO_TARGET_DIR="$srcdir/CeleMod-$pkgver/target"
    
      49  export CARGO_NET_OFFLINE=true
    
      50  export CMAKE_POLICY_VERSION_MINIMUM=3.5
    
      51  pnpm --dir src/celemod-ui tauri build --bundles deb
    
      52}
    
      53
    
      54package() {
    
      55  cd "$srcdir/CeleMod-$pkgver"
    
      56  install -Dm755 target/release/cele-mod \
    
      57    "$pkgdir/usr/bin/cele-mod"
    
      58  install -Dm644 "$srcdir/CeleMod.desktop" \
    
      59    "$pkgdir/usr/share/applications/CeleMod.desktop"
    
      60  install -Dm644 resources/icon.png \
    
      61    "$pkgdir/usr/share/icons/hicolor/128x128/apps/cele-mod.png"
    
      62  install -Dm644 LICENSE \
    
      63    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      64}
    
      65

Changes since previous scan

--- PKGBUILD @ 2026-09-21 00:26
+++ PKGBUILD @ 2026-10-02 00:00
@@ -2,7 +2,7 @@
 # Contributor: Dilant <dilant@qq.com>
 
 pkgname=celemod
-pkgver=1.1.11
+pkgver=1.2.1
 pkgrel=1
 pkgdesc="An alternative mod manager for Celeste"
 arch=('x86_64')
@@ -30,9 +30,9 @@
   'CeleMod.desktop'
   'disable-self-update.patch'
 )
-sha256sums=('65a2245dbec1a0f7f11bedd7f0bbb7202cad56c7dca26fa31ba7397d04b97448'
+sha256sums=('dfc9ea2c535fba508b22ed5404e86e4bb44a4e7273aa2b11158fd3124380e4bf'
             '683c5ab3017cb560d715576e0eb0342833f22b52ad17d9594499dfd2a7655c42'
-            '0de0b5e93d462d4f27ca7a37f93a95013c82f0cc643ebd7dfc4c0bfc780fa186')
+            '808ef279cf059a2fcdf25dd4b040a41866670aa27161b1d532ff67fc65cef303')
 
 prepare() {
   cd "$srcdir/CeleMod-$pkgver"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 01:33:35	Medium	1
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2