cuttletron-git
LOW
maintainer zxp19821005
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The flagged `npm add -D electron-reload` installs a well-known, legitimate Electron development helper from the official npm registry; it is not an undeclared malicious package, and the rest of the PKGBUILD is a standard Electron app build from the project's own GitHub source with no obfuscation or exfiltration.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The flagged `npm add -D electron-reload` installs a well-known, legitimate Electron development helper from the official npm registry; it is not an undeclared malicious package, and the rest of the PKGBUILD is a standard Electron app build from the project's own GitHub source with no obfuscation or exfiltration.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:94
npm add -D electron-reload
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=cuttletron-git
3
_pkgname=cuttleTron
4
pkgver=1.0.0.r1.g103e778
5
_electronversion=27
6
_nodeversion=20
7
pkgrel=1
8
pkgdesc="Screenshots, Screen/Window Recorder, Sound/Voice Effects; For Linux."
9
arch=('any')
10
url="https://github.com/mantzaris/cuttleTron"
11
license=("MIT")
12
conflicts=("${pkgname%-git}")
13
provides=("${pkgname%-git}=${pkgver%.r*}")
14
depends=(
15
"electron${_electronversion}-bin"
16
)
17
makedepends=(
18
'npm'
19
'git'
20
'nvm'
21
'gendesk'
22
'jq'
23
)
24
source=(
25
"${pkgname//-/.}::git+${url}.git"
26
"${pkgname%-git}.sh"
27
)
28
sha256sums=('SKIP'
29
'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
30
_get_project_dir() {
31
local d
32
while IFS= read -r d; do
33
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
34
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
35
}
36
pkgver() {
37
cd "$(_get_project_dir)"
38
set -o pipefail
39
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
40
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
41
}
42
_ensure_local_nvm() {
43
local NVM_DIR="${srcdir}/.nvm"
44
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
45
nvm install "${_nodeversion}"
46
nvm use "${_nodeversion}"
47
}
48
_get_app_dir() {
49
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
50
}
51
_get_electron_version() {
52
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
53
| xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
54
| grep -oE '[0-9]+' | head -1)
55
[[ -z "${_elec_ver}" ]] && return 1
56
(( _elec_ver == _electronversion )) && c=32 || c=31
57
echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
58
}
59
_set_build_env() {
60
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
61
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
62
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
63
export ELECTRON_BUILDER_OFFLINE=true
64
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
65
export HOME="${srcdir}/.home"
66
export XDG_CACHE_HOME="${HOME}/.cache"
67
export XDG_CONFIG_HOME="${HOME}/.config"
68
export XDG_DATA_HOME="${HOME}/.local/share"
69
export npm_config_cache="${HOME}/.npm_cache"
70
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
71
export COREPACK_HOME="${HOME}/.corepack"
72
export npm_config_audit=false
73
export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
74
mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
75
}
76
prepare(){
77
cd "$(_get_project_dir)"
78
_get_electron_version
79
sed -i -e "
80
s/@electronversion@/${_electronversion}/g
81
s/@appname@/${pkgname%-git}/g
82
" -i "${srcdir}/${pkgname%-git}.sh"
83
gendesk -q -f -n \
84
--pkgname="${pkgname%-git}" \
85
--pkgdesc="${pkgdesc}" \
86
--categories="Utility" \
87
--name="${_pkgname}" \
88
--exec="${pkgname%-git} %U"
89
_ensure_local_nvm
90
_set_build_env
91
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
92
export NODE_ENV=development
93
npm install --legacy-peer-deps
94
npm add -D electron-reload
95
}
96
build() {
97
cd "$(_get_project_dir)"
98
_ensure_local_nvm
99
_set_build_env
100
export NODE_ENV=production
101
npm run build
102
npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
103
}
104
package() {
105
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
106
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
107
rm -rf "$(_get_app_dir)/resources/default_app.asar"
108
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
109
install -Dm644 "$(_get_project_dir)/cuttlefish.png" "${pkgdir}/usr/share/icons/hicolor/64x64/apps/${pkgname%-git}.png"
110
install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
111
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
112
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 3 |
| 2026-10-16 00:12:47 | Low | 3 |
| 2026-10-15 00:28:05 | Low | 3 |
| 2026-10-14 00:06:47 | Low | 3 |
| 2026-10-13 11:18:29 | Low | 3 |
| 2026-10-13 11:16:23 | Medium | 2 |