dishylink

LOW

maintainer dbirks 0 votes scanned 2026-10-27 05:48:58.893783

View on AUR

Why flagged

The npx calls run tsc and vite from locally installed npm packages (via 'npm ci'), not from remote URLs; the source is the project's own GitHub release archive with a checksum, so this is a normal build-from-source AUR package with only minor concerns (SKIP'd checksum on the .desktop file and few votes).

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The npx calls run tsc and vite from locally installed npm packages (via 'npm ci'), not from remote URLs; the source is the project's own GitHub release archive with a checksum, so this is a normal build-from-source AUR package with only minor concerns (SKIP'd checksum on the .desktop file and few votes).

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:21 npx tsc -b
PKGBUILD:22 ELECTRON=1 npx vite build

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: David Birks <david@birks.dev>
    
      2
    
      3pkgname=dishylink
    
      4pkgver=1.3.0
    
      5pkgrel=1
    
      6pkgdesc="Desktop app to monitor the performance and health of your Starlink"
    
      7arch=('any')
    
      8url="https://dishylink.com"
    
      9license=('MIT')
    
      10depends=('electron')
    
      11makedepends=('nodejs' 'npm')
    
      12source=("${pkgname}-${pkgver}-sources.zip::https://github.com/DaveyHert/Dishylink/releases/download/v${pkgver}/dishylink-${pkgver}-sources.zip"
    
      13  'dishylink.desktop')
    
      14b2sums=('d00be799866179740328b3c61a8ec07cbded34dcf07c88fb50951692004687f05955737999386eacabcb5ddf09f881b6afe2c1b8523bcd05117582e53bb9a19e'
    
      15        'SKIP')
    
      16
    
      17build() {
    
      18  cd "${srcdir}"
    
      19  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      20  npm ci --ignore-scripts
    
      21  npx tsc -b
    
      22  ELECTRON=1 npx vite build
    
      23}
    
      24
    
      25package() {
    
      26  install -dm755 "${pkgdir}/usr/lib/${pkgname}"
    
      27  cp -a dist dist-electron "${pkgdir}/usr/lib/${pkgname}/"
    
      28  install -Dm644 build/icon.png "${pkgdir}/usr/lib/${pkgname}/build/icon.png"
    
      29  install -m644 build/trayTemplate.png "build/trayTemplate@2x.png" \
    
      30    "build/trayTemplateOutline.png" "build/trayTemplateOutline@2x.png" \
    
      31    "${pkgdir}/usr/lib/${pkgname}/build/"
    
      32  install -m644 package.json "${pkgdir}/usr/lib/${pkgname}/"
    
      33
    
      34  install -dm755 "${pkgdir}/usr/bin"
    
      35  printf '#!/bin/sh\nexec electron /usr/lib/%s "$@"\n' "${pkgname}" > "${pkgdir}/usr/bin/${pkgname}"
    
      36  chmod 755 "${pkgdir}/usr/bin/${pkgname}"
    
      37
    
      38  install -Dm644 "${srcdir}/dishylink.desktop" \
    
      39    "${pkgdir}/usr/share/applications/dishylink.desktop"
    
      40  install -Dm644 "${srcdir}/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      41  install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 05:48:58	Low	3
2026-10-27 05:46:44	Medium	2