companion

CLEAN

maintainer mdeboer 8 votes scanned 2026-10-22 00:13:10.488046

View on AUR

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): This is a legitimate PKGBUILD for Bitfocus Companion, a well-known open-source Elgato Stream Deck control application hosted on GitHub. The flagged 'npm install -g corepack' is a standard Node.js ecosystem pattern: corepack is an official Node.js tool for managing package manager versions (yarn/pnpm), and it is being installed globally within the sandboxed NVM environment to enable yarn. The package manager version is read directly from the project's own package.json ('packageManager' field), not from an external attacker-controlled source. The build process uses git+https from the official bitfocus/companion repository with a pinned tag and checksums. The NVM usage pattern (sourcing init-nvm.sh, using a local NVM_DIR under srcdir) is a common and legitimate approach for AUR packages that need a specific Node.js version. No obfuscated payloads, no exfiltration, no substitution of upstream sources, and no piracy concerns are present.

1 higher static finding superseded - not the current verdict (shown for transparency)

High npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time.

PKGBUILD:61 npm install -g corepack

PKGBUILD

1 offending line(s) highlighted

      1pkgname=companion
    
      2pkgver=5.1.0
    
      3pkgrel=1
    
      4pkgdesc="Control software for the Elgato Streamdeck with a focus on broadcasting."
    
      5arch=('x86_64' 'aarch64')
    
      6url="https://github.com/bitfocus/companion"
    
      7license=('custom')
    
      8depends=('gtk3' 'alsa-lib' 'nss' 'hicolor-icon-theme' 'libusb')
    
      9makedepends=('nvm' 'git' 'zip' 'python>=3.10.0')
    
      10install=companion.install
    
      11_node_version="26"
    
      12
    
      13source=("${pkgname}-${pkgver}::git+https://github.com/bitfocus/companion.git#tag=v${pkgver}"
    
      14		"bitfocus-companion.desktop")
    
      15
    
      16sha256sums=('f49453dfceab72c64331d492e550fd99bb2fff0ee945ed91b079236cd9434317'
    
      17            '65289895360dae94dd710e6804709c1e3f95e6bc275b1621cb88eb8a7cbd348f')
    
      18b2sums=('1ec0c65e8b5126b9cdfb58affa87db1cbb9582b5d3cb9d804ecb811b19b2cdbe222169a7d3cb02628257de7729c94ca599e6c2bfcd7435c5a2607daaed96652c'
    
      19        '718976c7c24fa0a2a8979a6704b36650ebe71e87edec944c1cc745cfa0e7e5aba7211efb3408b1bf12dc0065f838ed976bea75a818d5abefa23471e2e4354882')
    
      20
    
      21_ensure_local_nvm() {
    
      22	# let's be sure we are starting clean
    
      23	which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      24	export NVM_DIR="${srcdir}/.nvm"
    
      25
    
      26	# The init script returns 3 if version specified
    
      27	# in ./.nvrc is not (yet) installed in $NVM_DIR
    
      28	# but nvm itself still gets loaded ok
    
      29	source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      30	
    
      31	export SHARP_IGNORE_GLOBAL_LIBVIPS=yes
    
      32	export YARN_CACHE_FOLDER="${srcdir}/yarn"
    
      33}
    
      34
    
      35prepare() {
    
      36	_ensure_local_nvm
    
      37
    
      38	rm -Rf "${srcdir}/npm"
    
      39	mkdir "${srcdir}/npm"
    
      40	rm -Rf "${srcdir}/yarn"
    
      41	mkdir "${srcdir}/yarn"
    
      42
    
      43	cd "${srcdir}/${pkgname}-${pkgver}"
    
      44
    
      45	# Init submodules
    
      46	git submodule update --init
    
      47
    
      48	# Node version
    
      49	if [[ -f ".node-version" ]]; then
    
      50		_upstream_node_version="$(<.node-version)"
    
      51		echo "Found .node_version file, setting node version to ${_upstream_node_version}"
    
      52		_node_version="${_upstream_node_version}"
    
      53	else
    
      54		echo "WARNING: could not locate .node-version file, using fallback version: ${_node_version}" >&2
    
      55	fi
    
      56
    
      57	nvm install "${_node_version}"
    
      58	npm config set cache "${srcdir}/npm"
    
      59
    
      60	# Enable corepack
    
      61	npm install -g corepack
    
      62	corepack enable
    
      63	corepack prepare "$(node -p 'require("./package.json").packageManager')" --activate
    
      64
    
      65	yarn --immutable
    
      66}
    
      67
    
      68build() {
    
      69	_ensure_local_nvm
    
      70
    
      71	cd "${srcdir}/${pkgname}-${pkgver}"
    
      72
    
      73	rm -rf electron-output
    
      74
    
      75	yarn run dist
    
      76}
    
      77
    
      78package() {
    
      79	cd "${srcdir}"
    
      80
    
      81	builddir="${pkgname}-${pkgver}/electron-output/linux-unpacked"
    
      82	if [ "${CARCH}" = "aarch64" ]; then
    
      83		builddir="${pkgname}-${pkgver}/electron-output/linux-arm64-unpacked"
    
      84	fi
    
      85
    
      86	# Licenses
    
      87	install -Dm644 "${pkgname}-${pkgver}/LICENSE.md" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      88	install -Dm644 "${builddir}/LICENSE.electron.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      89	install -Dm644 "${builddir}/LICENSES.chromium.html" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      90
    
      91	# Companion
    
      92	install -d "${pkgdir}/usr/lib/bitfocus-companion"
    
      93
    
      94	cp -R "${builddir}"/* "${pkgdir}/usr/lib/bitfocus-companion"
    
      95
    
      96	rm -f "${pkgdir}/usr/lib/bitfocus-companion/resources/node-runtime/bin/npm"
    
      97	rm -f "${pkgdir}/usr/lib/bitfocus-companion/resources/node-runtime/bin/npx"
    
      98
    
      99	# Install bin symlinks
    
      100	install -d "${pkgdir}/usr/bin"
    
      101
    
      102	ln -sv "/usr/lib/bitfocus-companion/companion-launcher" "${pkgdir}/usr/bin/companion"
    
      103	ln -sv "/usr/lib/bitfocus-companion/companion_headless.sh" "${pkgdir}/usr/bin/companion-headless"
    
      104
    
      105	# Desktop file
    
      106	install -Dm644 bitfocus-companion.desktop -t "${pkgdir}/usr/share/applications/"
    
      107
    
      108	# Icon
    
      109	install -Dm644 "${pkgname}-${pkgver}/launcher/assets/icon.png" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/bitfocus-companion.png"
    
      110}
    
      111

Changes since previous scan

--- PKGBUILD @ 2026-09-26 03:13
+++ PKGBUILD @ 2026-10-22 00:13
@@ -1,5 +1,5 @@
 pkgname=companion
-pkgver=5.0.2
+pkgver=5.1.0
 pkgrel=1
 pkgdesc="Control software for the Elgato Streamdeck with a focus on broadcasting."
 arch=('x86_64' 'aarch64')
@@ -8,14 +8,14 @@
 depends=('gtk3' 'alsa-lib' 'nss' 'hicolor-icon-theme' 'libusb')
 makedepends=('nvm' 'git' 'zip' 'python>=3.10.0')
 install=companion.install
-_node_version="22"
+_node_version="26"
 
 source=("${pkgname}-${pkgver}::git+https://github.com/bitfocus/companion.git#tag=v${pkgver}"
 		"bitfocus-companion.desktop")
 
-sha256sums=('a9854d2737ed7de2ff9cb0aff1fa594df500b4e33b54769380c3efb2fa51dafb'
+sha256sums=('f49453dfceab72c64331d492e550fd99bb2fff0ee945ed91b079236cd9434317'
             '65289895360dae94dd710e6804709c1e3f95e6bc275b1621cb88eb8a7cbd348f')
-b2sums=('4f0a0fe6f6a05e45998cc5920d8930235f7b6b0331a7ba004d47d0c9dffb60730723b63baa51b5b2ec6f40f0523ca3e8ec9a48a351070beda6283d8ae8d03410'
+b2sums=('1ec0c65e8b5126b9cdfb58affa87db1cbb9582b5d3cb9d804ecb811b19b2cdbe222169a7d3cb02628257de7729c94ca599e6c2bfcd7435c5a2607daaed96652c'
         '718976c7c24fa0a2a8979a6704b36650ebe71e87edec944c1cc745cfa0e7e5aba7211efb3408b1bf12dc0065f838ed976bea75a818d5abefa23471e2e4354882')
 
 _ensure_local_nvm() {
@@ -28,7 +28,6 @@
 	# but nvm itself still gets loaded ok
 	source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
 	
-	export PATH="$(npm bin):${PATH}"
 	export SHARP_IGNORE_GLOBAL_LIBVIPS=yes
 	export YARN_CACHE_FOLDER="${srcdir}/yarn"
 }
@@ -46,11 +45,22 @@
 	# Init submodules
 	git submodule update --init
 
+	# Node version
+	if [[ -f ".node-version" ]]; then
+		_upstream_node_version="$(<.node-version)"
+		echo "Found .node_version file, setting node version to ${_upstream_node_version}"
+		_node_version="${_upstream_node_version}"
+	else
+		echo "WARNING: could not locate .node-version file, using fallback version: ${_node_version}" >&2
+	fi
+
 	nvm install "${_node_version}"
 	npm config set cache "${srcdir}/npm"
 
 	# Enable corepack
+	npm install -g corepack
 	corepack enable
+	corepack prepare "$(node -p 'require("./package.json").packageManager')" --activate
 
 	yarn --immutable
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-22 00:13:10	Clean	2
2026-10-21 23:33:14	High	1
2026-10-12 17:16:58	Clean	2
2026-10-12 17:14:20	High	1
2026-09-26 03:13:55	Clean	0
2026-07-21 03:15:42	Clean	0
2026-07-15 01:46:53	Clean	0
2026-07-13 23:43:33	Clean	0
2026-06-18 16:11:54	Clean	0