deadlock-modmanager

MEDIUM

maintainer stormix 6 votes scanned 2026-10-21 19:33:05.748742

View on AUR

Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

PKGBUILD:32 pnpm install --frozen-lockfile --filter @deadlock-mods/desktop...

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: stormix <hello@stormix.co>
    
      2pkgname=deadlock-modmanager
    
      3pkgdesc='A mod manager for the Valve game Deadlock'
    
      4_pkgver=2.0.0
    
      5pkgver=${_pkgver}
    
      6pkgrel=1
    
      7arch=('x86_64')
    
      8url='https://github.com/deadlock-mod-manager/deadlock-mod-manager'
    
      9license=('GPL-3.0-only')
    
      10makedepends=('cargo' 'cargo-tauri' 'nodejs' 'pnpm' 'protobuf'
    
      11             'libayatana-appindicator')
    
      12depends=('webkit2gtk-4.1' 'cairo' 'desktop-file-utils' 'xdg-utils' 'gdk-pixbuf2'
    
      13         'glib2' 'gtk3' 'libsoup3' 'pango' 'openssl' 'bzip2' 'hicolor-icon-theme'
    
      14         'gst-plugins-good' 'glibc' 'libgcc' 'libstdc++' 'dbus')
    
      15conflicts=('deadlock-modmanager-bin' 'deadlock-modmanager-git')
    
      16source=("${pkgname}-${_pkgver}.tar.gz::https://github.com/deadlock-mod-manager/deadlock-mod-manager/archive/refs/tags/v${_pkgver}.tar.gz")
    
      17sha256sums=('117b221439b1e938d2eb2e1738c396f318d6167d68f629e5def63c09178824bc')
    
      18
    
      19prepare() {
    
      20    cd "${srcdir}/deadlock-mod-manager-${_pkgver}/apps/desktop"
    
      21
    
      22    # v1.1.0 pins valveprotos to deadlock-api/valveprotos-rs, which was merged
    
      23    # into the deadlock-api monorepo (same rev). Drop once _pkgver moves past 1.1.0.
    
      24    sed -i 's#deadlock-api/valveprotos-rs#deadlock-api/deadlock-api#' src-tauri/Cargo.toml Cargo.lock
    
      25
    
      26    # v1.1.0's desktop install still pulls sharp via better-auth's next peer, and a
    
      27    # system libvips makes sharp build from source with npm. Drop once _pkgver moves
    
      28    # past 1.1.0.
    
      29    export SHARP_IGNORE_GLOBAL_LIBVIPS=1
    
      30    # The root impeccable devDependency pulls puppeteer, whose postinstall downloads Chrome.
    
      31    export PUPPETEER_SKIP_DOWNLOAD=1
    
      32    pnpm install --frozen-lockfile --filter @deadlock-mods/desktop...
    
      33
    
      34    cd src-tauri
    
      35    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      36}
    
      37
    
      38build() {
    
      39    export CC=gcc
    
      40    export CXX=g++
    
      41    export CFLAGS+=" -ffat-lto-objects"
    
      42    export CXXFLAGS+=" -ffat-lto-objects"
    
      43    export CARGO_TARGET_DIR=target
    
      44    export VITE_API_URL="https://api.deadlockmods.app"
    
      45    export VITE_WEB_URL="https://deadlockmods.app"
    
      46    export VITE_AUTH_URL="https://auth.deadlockmods.app"
    
      47
    
      48    cd "${srcdir}/deadlock-mod-manager-${_pkgver}/apps/desktop"
    
      49    cargo tauri build --no-bundle -- --frozen
    
      50}
    
      51
    
      52package() {
    
      53    local _srcroot="${srcdir}/deadlock-mod-manager-${_pkgver}"
    
      54    local _tauri="${_srcroot}/apps/desktop/src-tauri"
    
      55
    
      56    install -Dm644 "${_srcroot}/distribution/aur/deadlock-modmanager.desktop" \
    
      57        "${pkgdir}/usr/share/applications/deadlock-modmanager.desktop"
    
      58
    
      59    install -Dm755 "${_tauri}/target/release/deadlock-mod-manager" \
    
      60        "${pkgdir}/usr/bin/deadlock-modmanager"
    
      61    install -Dm644 "${_tauri}/icons/32x32.png" \
    
      62        "${pkgdir}/usr/share/icons/hicolor/32x32/apps/deadlock-modmanager.png"
    
      63    install -Dm644 "${_tauri}/icons/128x128.png" \
    
      64        "${pkgdir}/usr/share/icons/hicolor/128x128/apps/deadlock-modmanager.png"
    
      65    install -Dm644 "${_tauri}/icons/128x128@2x.png" \
    
      66        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/deadlock-modmanager.png"
    
      67    install -Dm644 "${_tauri}/icons/icon.png" \
    
      68        "${pkgdir}/usr/share/icons/hicolor/512x512/apps/deadlock-modmanager.png"
    
      69
    
      70    install -Dm644 "${_tauri}/dev.stormix.deadlock-mod-manager.metainfo.xml" \
    
      71        "${pkgdir}/usr/share/metainfo/dev.stormix.deadlock-mod-manager.metainfo.xml"
    
      72}
    
      73

Changes since previous scan

--- PKGBUILD @ 2026-10-19 15:25
+++ PKGBUILD @ 2026-10-21 19:33
@@ -1,19 +1,20 @@
 # Maintainer: stormix <hello@stormix.co>
 pkgname=deadlock-modmanager
 pkgdesc='A mod manager for the Valve game Deadlock'
-_pkgver=1.1.0
+_pkgver=2.0.0
 pkgver=${_pkgver}
-pkgrel=4
+pkgrel=1
 arch=('x86_64')
 url='https://github.com/deadlock-mod-manager/deadlock-mod-manager'
 license=('GPL-3.0-only')
-makedepends=('cargo' 'cargo-tauri' 'pnpm' 'protobuf')
+makedepends=('cargo' 'cargo-tauri' 'nodejs' 'pnpm' 'protobuf'
+             'libayatana-appindicator')
 depends=('webkit2gtk-4.1' 'cairo' 'desktop-file-utils' 'xdg-utils' 'gdk-pixbuf2'
          'glib2' 'gtk3' 'libsoup3' 'pango' 'openssl' 'bzip2' 'hicolor-icon-theme'
          'gst-plugins-good' 'glibc' 'libgcc' 'libstdc++' 'dbus')
 conflicts=('deadlock-modmanager-bin' 'deadlock-modmanager-git')
 source=("${pkgname}-${_pkgver}.tar.gz::https://github.com/deadlock-mod-manager/deadlock-mod-manager/archive/refs/tags/v${_pkgver}.tar.gz")
-sha256sums=('d37f382cc3708ed6cd2de12e43fc92f0f00eb96bcbd711659e773118c10a31b1')
+sha256sums=('117b221439b1e938d2eb2e1738c396f318d6167d68f629e5def63c09178824bc')
 
 prepare() {
     cd "${srcdir}/deadlock-mod-manager-${_pkgver}/apps/desktop"
@@ -22,7 +23,13 @@
     # into the deadlock-api monorepo (same rev). Drop once _pkgver moves past 1.1.0.
     sed -i 's#deadlock-api/valveprotos-rs#deadlock-api/deadlock-api#' src-tauri/Cargo.toml Cargo.lock
 
-    pnpm install
+    # v1.1.0's desktop install still pulls sharp via better-auth's next peer, and a
+    # system libvips makes sharp build from source with npm. Drop once _pkgver moves
+    # past 1.1.0.
+    export SHARP_IGNORE_GLOBAL_LIBVIPS=1
+    # The root impeccable devDependency pulls puppeteer, whose postinstall downloads Chrome.
+    export PUPPETEER_SKIP_DOWNLOAD=1
+    pnpm install --frozen-lockfile --filter @deadlock-mods/desktop...
 
     cd src-tauri
     cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 19:33:05	Medium	1
2026-10-19 15:25:12	Clean	0
2026-10-05 23:40:58	Clean	0
2026-09-12 11:11:46	Clean	0
2026-06-18 16:11:54	Clean	0