colanode-git

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs dependencies via npm during prepare(), but all operations are performed on the project's own source code from its official GitHub repository, using standard build practices; the flagged external package install is part of the project's legitimate build process and not an obfuscated remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package installs dependencies via npm during prepare(), but all operations are performed on the project's own source code from its official GitHub repository, using standard build practices; the flagged external package install is part of the project's legitimate build process and not an obfuscated remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:89 NODE_ENV=development npm add -D @electron-forge/plugin-local-electron

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=colanode-git
    
      3_pkgname=Colanode
    
      4pkgver=0.4.6.r1.ged5327a
    
      5_electronversion=40
    
      6_nodeversion=22
    
      7pkgrel=1
    
      8pkgdesc="Open-source and local-first Slack and Notion alternative that puts you in control of your data.(Use system-wide electron)"
    
      9arch=('any')
    
      10url="https://colanode.com/"
    
      11_ghurl="https://github.com/colanode/colanode"
    
      12license=('Apache-2.0')
    
      13provides=("${pkgname%-git}=${pkgver%.r*}")
    
      14conflicts=("${pkgname%-git}")
    
      15depends=(
    
  "electron${_electronversion}"
    
      17)
    
      18makedepends=(
    
  'npm'
    
  'nvm'
    
  'git'
    
  'curl'
    
  'gendesk'
    
  'jq'
    
      25)
    
      26source=(
    
  "${pkgname//-/.}::git+${_ghurl}.git"
    
  "${pkgname%-git}.sh"
    
      29)
    
      30sha256sums=('SKIP'
    
          '31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
    
      32pkgver() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  set -o pipefail
    
  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      37}
    
      38_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      43}
    
      44_get_electron_version() {
    
  _elec_ver=$(jq -r '.devDependencies["electron"] // .dependencies["electron"]' "${srcdir}/${pkgname//-/.}/apps/desktop/package.json" | tr -d '^')
    
  _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
    
  echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
    
      48}
    
      49prepare() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  _get_electron_version
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname%-git}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${_pkgname}/g
    
      s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
    
  " "${srcdir}/${pkgname%-git}.sh"
    
  gendesk -q -f -n \
    
      --pkgname="${pkgname%-git}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="Utility" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname%-git} %U"
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  HOME="${srcdir}/.electron-gyp"
    
  {
    
      echo -e '\n'
    
      #echo 'build_from_source=true'
    
      echo "cache=${srcdir}/.npm_cache"
    
      echo "maxsockets=10"
    
  } >> .npmrc
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      {
    
          echo 'registry=https://registry.npmmirror.com'
    
          echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
    
          echo 'electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/'
    
      } >> .npmrc
    
      echo apps/desktop packages/{client,core,crdt,ui} | xargs -n 1 cp .npmrc
    
      find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
    
  fi
    
  _ensure_local_nvm
    
  NODE_ENV=development    npm install
    
  cd "${srcdir}/${pkgname//-/.}/apps/desktop"
    
  find src -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  NODE_ENV=development    npm install
    
  NODE_ENV=development    npm add -D @electron-forge/plugin-local-electron
    
  cd "${srcdir}/${pkgname//-/.}/packages/client"
    
  NODE_ENV=development    npm install
    
  cd "${srcdir}/${pkgname//-/.}/packages/core"
    
  NODE_ENV=development    npm install
    
  cd "${srcdir}/${pkgname//-/.}/packages/crdt"
    
  NODE_ENV=development    npm install
    
  cd "${srcdir}/${pkgname//-/.}/packages/ui"
    
  NODE_ENV=development    npm install
    
      98}
    
      99build() {
    
  cd "${srcdir}/${pkgname//-/.}/apps/desktop"
    
  _ensure_local_nvm
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  local electronDist="/usr/lib/electron${_electronversion}"
    
  sed -i "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
    
  {\\
    
      name: \"@electron-forge/plugin-local-electron\",\\
    
      config: {\\
    
          electronPath: \'${electronDist}\',\\
    
      },\\
    
  }," forge.config.*
    
  NODE_ENV=production     npm run package
    
      112}
    
      113package() {
    
  install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
    
find "${srcdir}/${pkgname//-/.}/apps/desktop/out/${_pkgname}-linux-"*"/resources" -maxdepth 1 -type f -exec install -Dm644 -t "${pkgdir}/usr/lib/${pkgname%-git}" {} +
    
  if find "${srcdir}/${pkgname//-/.}/apps/desktop/out/${_pkgname}-linux-"*"/resources" -mindepth 1 -maxdepth 1 -type d | read; then
    
      for _subdir in "${srcdir}/${pkgname//-/.}/apps/desktop/out/${_pkgname}-linux-"*"/resources/"*; do
    
          if [ -d "${_subdir}" ]; then
    
              cp -Pr --no-preserve=ownership "${_subdir}" "${pkgdir}/usr/lib/${pkgname%-git}"
    
          fi
    
      done
    
  fi
    
  install -Dm644 "${srcdir}/${pkgname//-/.}/assets/images/${pkgname%-git}-logo-black-512.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
    
  install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      127}
    
      128

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2