devkitty

LOW
maintainer zxp19821005 0 votes scanned 2026-10-17 00:21:55.226236
View on AUR
Why flagged

The package builds from a legitimate project source on GitHub, uses standard build tools, and installs dependencies via pnpm with version constraints; the variable-named package installation is part of normal project dependency resolution and not an obfuscated remote code execution.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a legitimate project source on GitHub, uses standard build tools, and installs dependencies via pnpm with version constraints; the variable-named package installation is part of normal project dependency resolution and not an obfuscated remote code execution.

  • PKGBUILD:85 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=devkitty
3_pkgname=Devkitty
4pkgver=4.6.2
5_electronversion=41
6_nodeversion=24
7pkgrel=1
8pkgdesc="Swiss army knife for developers.All your repos. One calm window."
9arch=('any')
10url="https://devkitty.app/"
11_ghurl="https://github.com/egor-xyz/devkitty"
12license=('MIT')
13conflicts=("${pkgname}")
14depends=(
15 "electron${_electronversion}"
16)
17makedepends=(
18 'gendesk'
19 'pnpm'
20 'nvm'
21 'git'
22 'jq'
23)
24source=(
25 "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
26 "${pkgname}.sh"
27)
28sha256sums=('e32352a282d398a71aed41246dec46d9ff5fcfd5e1c41d38cd3d7dcf0b30e80f'
29 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
30_get_project_dir() {
31 local d
32 while IFS= read -r d; do
33 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
34 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
35}
36_ensure_local_nvm() {
37 local NVM_DIR="${srcdir}/.nvm"
38 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
39 nvm install "${_nodeversion}"
40 nvm use "${_nodeversion}"
41}
42_get_app_dir() {
43 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
44}
45_get_electron_version() {
46 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
47 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
48 | grep -oE '[0-9]+' | head -1)
49 [[ -z "${_elec_ver}" ]] && return 1
50 (( _elec_ver == _electronversion )) && c=32 || c=31
51 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
52}
53_set_build_env() {
54 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
55 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
56 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
57 export ELECTRON_BUILDER_OFFLINE=true
58 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
59 export HOME="${srcdir}/.home"
60 export XDG_CACHE_HOME="${HOME}/.cache"
61 export XDG_CONFIG_HOME="${HOME}/.config"
62 export XDG_DATA_HOME="${HOME}/.local/share"
63 export XDG_STATE_HOME="${HOME}/.local/state"
64 export PNPM_HOME="${HOME}/.pnpm/bin"
65 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
66 export pnpm_config_store_dir="${HOME}/.pnpm_store"
67 export pnpm_config_global_dir="${HOME}/.pnpm/global"
68 export pnpm_config_state_dir="${HOME}/.pnpm/state"
69 export pnpm_config_node_linker=hoisted
70 export pnpm_config_minimum_release_age=0
71 export pnpm_config_update_notifier=false
72 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
73 export COREPACK_HOME="${HOME}/.corepack"
74 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
75 export PATH="${PNPM_HOME}:${PATH}"
76 local _pnpmver=""
77 local _pkgjson="$(_get_project_dir)/package.json"
78 if [ -f "${_pkgjson}" ]; then
79 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
80 if [ -z "${_pnpmver}" ]; then
81 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
82 fi
83 fi
84 if [ -n "${_pnpmver}" ]; then
85 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
86 --registry "${COREPACK_NPM_REGISTRY}"
87 fi
88}
89prepare() {
90 cd "$(_get_project_dir)"
91 _get_electron_version
92 sed -i -e "
93 s/@electronversion@/${_electronversion}/g
94 s/@appname@/${pkgname}/g
95 " "${srcdir}/${pkgname}.sh"
96 gendesk -q -f -n \
97 --pkgname="${pkgname}" \
98 --pkgdesc="${pkgdesc}" \
99 --categories="Development" \
100 --name="${_pkgname}" \
101 --exec="${pkgname} %U"
102 _ensure_local_nvm
103 _set_build_env
104 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
105 export NODE_ENV=development
106 pnpm install
107}
108build() {
109 cd "$(_get_project_dir)"
110 _ensure_local_nvm
111 _set_build_env
112 export NODE_ENV=production
113 pnpm run build
114 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
115}
116package() {
117 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
118 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
119 rm -rf "$(_get_app_dir)/resources/default_app.asar"
120 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
121 install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
122 install -Dm644 "$(_get_project_dir)/assets/logo.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
123 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
124}

Changes since previous scan

--- PKGBUILD @ 2026-09-17 07:25
+++ PKGBUILD @ 2026-10-17 00:21
@@ -3,7 +3,7 @@
_pkgname=Devkitty
pkgver=4.6.2
_electronversion=41
-_nodeversion=25
+_nodeversion=24
pkgrel=1
pkgdesc="Swiss army knife for developers.All your repos. One calm window."
arch=('any')
@@ -18,12 +18,21 @@
'gendesk'
'pnpm'
'nvm'
- 'curl'
'git'
'jq'
)
-source=("${pkgname}.sh")
-sha256sums=('a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+source=(
+ "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
+ "${pkgname}.sh"
+)
+sha256sums=('e32352a282d398a71aed41246dec46d9ff5fcfd5e1c41d38cd3d7dcf0b30e80f'
+ 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
@@ -31,57 +40,58 @@
nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
+}
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- export HOME="${srcdir}/.electron-gyp"
- {
- export PNPM_LINK_WORKSPACE_PACKAGES=true
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_SHAMEFULLY_HOIST=true
- export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
- export PNPM_NODE_LINKER=hoisted
- export PNPM_NETWORK_CONCURRENCY=32
- }
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export pnpm_config_registry="https://registry.npmmirror.com"
- export npm_config_registry="https://registry.npmmirror.com"
- export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
- export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- }
- fi
-}
-_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
prepare() {
- cd "${srcdir}"
- if [ ! -d "${pkgname}-${pkgver}" ]; then
- git clone \
- --depth 1 \
- --branch "v${pkgver}" \
- "${_ghurl}" \
- "${pkgname}-${pkgver}"
- fi
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${_pkgname}/g
- s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
" "${srcdir}/${pkgname}.sh"
gendesk -q -f -n \
--pkgname="${pkgname}" \
@@ -89,26 +99,26 @@
--categories="Development" \
--name="${_pkgname}" \
--exec="${pkgname} %U"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development pnpm install
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ export NODE_ENV=development
+ pnpm install
}
build() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- NODE_ENV=production pnpm run build
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
+ export NODE_ENV=production
+ pnpm run build
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
- rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/assets/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
+ install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/assets/logo.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
-

Scan history

Scanned at (UTC)SeverityRules
2026-10-17 00:21:55 Low 1
2026-10-16 00:12:47 Low 1
2026-10-15 00:28:05 Low 1
2026-10-14 00:06:47 Low 1
2026-10-13 11:16:23 Low 1
2026-09-17 07:25:15 Clean 0
2026-09-10 13:20:36 Clean 0
2026-09-10 05:20:15 Clean 0
2026-09-09 09:19:26 Clean 0
2026-09-07 07:13:50 Clean 0
2026-09-02 13:50:58 Clean 0
2026-09-01 01:46:26 Clean 0
2026-08-31 05:44:47 Clean 0
2026-08-27 03:31:49 Clean 0
2026-08-19 03:41:13 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion