cloudreve-client

MEDIUM

maintainer Loooooooooong 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The PKGBUILD fetches and installs '@tauri-apps/cli@2' from npm at build time (line 46) rather than declaring it as a makedepend or vendoring it, meaning an npm registry compromise or version-range substitution could inject arbitrary code into the build process; combined with few votes and a recently uploaded personal-fork package, this represents a modest but real supply-chain risk beyond normal source building.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:46 npm install --no-audit --no-fund --prefix . '@tauri-apps/cli@2'

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 60%): The PKGBUILD fetches and installs '@tauri-apps/cli@2' from npm at build time (line 46) rather than declaring it as a makedepend or vendoring it, meaning an npm registry compromise or version-range substitution could inject arbitrary code into the build process; combined with few votes and a recently uploaded personal-fork package, this represents a modest but real supply-chain risk beyond normal source building.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Loong <xiaoyueban@nmgjg.com.cn>
    
      2
    
      3pkgname=cloudreve-client
    
      4pkgver=0.3.0
    
      5pkgrel=1
    
      6pkgdesc="Desktop sync client for Cloudreve (Linux/macOS fork of the official Windows client)"
    
      7arch=('x86_64')
    
      8url="https://github.com/cedev-1/cloudreve-client"
    
      9license=('MIT')
    
      10depends=('webkit2gtk-4.1' 'gtk3' 'libayatana-appindicator' 'hicolor-icon-theme' 'sqlite')
    
      11makedepends=('cargo' 'nodejs' 'npm' 'pkgconf')
    
      12# Mixed Rust/C/C++ (bundled C deps): GCC LTO breaks rustc's lld link (Arch wiki)
    
      13options=('!lto')
    
      14source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      15        'fix-wayland-positioner.patch')
    
      16sha256sums=('352325d6f9a1f21b73611fd3463ae16d74fd45d26824f4cb14686e5bb015189f'
    
      17            '058885c8daeca4573a74be69c89fb3bcba63c374116609d676f11314cb67805b')
    
      18
    
      19prepare() {
    
      20  cd "$pkgname-$pkgver"
    
      21
    
      22  # Unbundle libsqlite3-sys: link the system sqlite (Arch wiki)
    
      23  export LIBSQLITE3_SYS_USE_PKG_CONFIG=1
    
      24
    
      25  # Upstream build scripts assume yarn; use npm instead
    
      26  sed -i 's/yarn run/npm run/g' src-tauri/tauri.conf.json
    
      27
    
      28  # Wayland tray crash fix merged upstream as #9 (ships in the next release)
    
      29  patch -Np1 -i "$srcdir/fix-wayland-positioner.patch"
    
      30
    
      31  # Root package.json so `npm run build` resolves wherever the tauri CLI
    
      32  # runs the beforeBuildCommand from
    
      33  cat > package.json <<'EOF'
    
      34{
    
      35  "name": "cloudreve-client-root",
    
      36  "private": true,
    
      37  "scripts": {
    
      38    "build": "npm --prefix ui run build",
    
      39    "dev": "npm --prefix ui run dev"
    
      40  }
    
      41}
    
      42EOF
    
      43
    
      44  # Network phase: frontend deps, tauri CLI, and all cargo crates
    
      45  npm --prefix ui install --no-audit --no-fund
    
      46  npm install --no-audit --no-fund --prefix . '@tauri-apps/cli@2'
    
      47  cargo fetch --locked --manifest-path src-tauri/Cargo.toml
    
      48}
    
      49
    
      50build() {
    
      51  cd "$pkgname-$pkgver"
    
      52  export LIBSQLITE3_SYS_USE_PKG_CONFIG=1
    
      53  # Everything is pre-fetched in prepare(); keep the build offline
    
      54  export CARGO_NET_OFFLINE=true
    
      55  ./node_modules/.bin/tauri build --no-bundle
    
      56}
    
      57
    
      58package() {
    
      59  cd "$pkgname-$pkgver"
    
      60  install -Dm755 target/release/cloudreve-desktop \
    
      61    "$pkgdir/usr/bin/cloudreve-desktop"
    
      62
    
      63  for size in 32x32 64x64 128x128; do
    
      64    install -Dm644 "src-tauri/icons/$size.png" \
    
      65      "$pkgdir/usr/share/icons/hicolor/$size/apps/cloudreve-desktop.png"
    
      66  done
    
      67  install -Dm644 src-tauri/icons/128x128@2x.png \
    
      68    "$pkgdir/usr/share/icons/hicolor/256x256/apps/cloudreve-desktop.png"
    
      69
    
      70  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/cloudreve-desktop.desktop" <<'EOF'
    
      71[Desktop Entry]
    
      72Type=Application
    
      73Name=Cloudreve
    
      74GenericName=Cloud Sync Client
    
      75Comment=Sync folders with a Cloudreve server
    
      76Exec=cloudreve-desktop
    
      77Icon=cloudreve-desktop
    
      78Terminal=false
    
      79Categories=Network;FileTransfer;
    
      80EOF
    
      81}
    
      82

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3
2026-10-14 00:06:47	Medium	3
2026-10-13 00:23:45	Medium	3
2026-10-12 01:13:21	Medium	3
2026-10-12 01:11:47	Medium	2