electerm
MEDIUM
maintainer zxp19821005
0 votes
scanned 2026-09-17 07:25:15.887874
Why flagged
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
Triggered rules
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:91
NODE_ENV=development npm add -D node-gyp --legacy-peer-deps
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
# Contributor: Zaoqi
3
pkgname=electerm
4
pkgver=5.5.15
5
_electronversion=42
6
_nodeversion=24
7
pkgrel=1
8
pkgdesc="đź“»Free and open-sourced terminal/ssh/sftp/ftp/telnet/serialport/RDP/VNC/Spice client."
9
arch=(
10
'aarch64'
11
'armv7h'
12
'x86_64'
13
)
14
url="https://electerm.org/"
15
_ghurl="https://github.com/electerm/electerm"
16
license=('MIT')
17
conflicts=("${pkgname}")
18
depends=(
19
"electron${_electronversion}"
20
'python'
21
'nodejs'
22
)
23
makedepends=(
24
'npm'
25
'nvm'
26
'gendesk'
27
'python-setuptools'
28
'curl'
29
'git'
30
'jq'
31
)
32
source=(
33
"${pkgname}-${pkgver}::git+${_ghurl}#tag=v${pkgver}"
34
"${pkgname}.sh"
35
)
36
sha256sums=('ecf021f141b65d7fbc69724345d5feed664b152431072323a7725cab07953da4'
37
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
38
_ensure_local_nvm() {
39
local NVM_DIR="${srcdir}/.nvm"
40
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
41
nvm install "${_nodeversion}"
42
nvm use "${_nodeversion}"
43
}
44
_get_app_dir() {
45
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
46
}
47
_set_build_env() {
48
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
49
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
50
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
51
_ev="$(electron${_electronversion} -v)"
52
export SYSTEM_ELECTRON_VERSION="${_ev#v}"
53
export HOME="${srcdir}/.electron-gyp"
54
export XDG_CACHE_HOME="${srcdir}/.cache"
55
export XDG_CONFIG_HOME="${srcdir}/.config"
56
export XDG_DATA_HOME="${srcdir}/.local/share"
57
export npm_config_cache="${srcdir}/.npm_cache"
58
export npm_config_maxsockets=32
59
export npm_config_audit=false
60
export npm_config_fund=false
61
export npm_config_progress=false
62
export NODE_OPTIONS="--max-old-space-size=4096"
63
export npm_config_node_options="--max-old-space-size=4096"
64
}
65
_get_electron_version() {
66
_elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
67
-exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
68
[[ -z "${_elec_ver}" ]] && return 1
69
echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
70
}
71
prepare() {
72
cd "${srcdir}/${pkgname}-${pkgver}"
73
_get_electron_version
74
sed -i -e "
75
s/@electronversion@/${_electronversion}/g
76
s/@appname@/${pkgname}/g
77
s/@runname@/app.asar/g
78
s/@cfgdirname@/${pkgname}/g
79
s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
80
" "${srcdir}/${pkgname}.sh"
81
gendesk -q -f -n \
82
--pkgname="${pkgname}" \
83
--pkgdesc="${pkgdesc}" \
84
--categories="System" \
85
--name="${pkgname}" \
86
--exec="${pkgname} %U"
87
_set_build_env
88
_ensure_local_nvm
89
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
90
NODE_ENV=development npm install --legacy-peer-deps
91
NODE_ENV=development npm add -D node-gyp --legacy-peer-deps
92
}
93
build() {
94
cd "${srcdir}/${pkgname}-${pkgver}"
95
_set_build_env
96
_ensure_local_nvm
97
local _app_dir=$(_get_app_dir)
98
NODE_ENV=production npm run clean
99
NODE_ENV=production npm run compile
100
NODE_ENV=production npm run prepare-file
101
WORKFLOW_NAME=linux-pkgbuild \
102
NODE_ENV=production npm exec -c "electron-builder --linux dir --publish never -c.electronDist=${ELECTRON_DIST} --config build/electron-builder.json"
103
rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/prebuilds/"{android-*,darwin-*,win32-*}
104
rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/font-list/libs/"{darwin,win32}
105
case "${CARCH}" in
106
aarch64)
107
rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/prebuilds/"{linux-arm,linux-x64}
108
;;
109
armv7h)
110
rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/prebuilds/"{linux-arm64,linux-x64}
111
;;
112
x86_64)
113
rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/prebuilds/"linux-arm*
114
;;
115
esac
116
}
117
package() {
118
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
119
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
120
local _app_dir=$(_get_app_dir)
121
cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
122
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/node_modules/@${pkgname}/${pkgname}-resource/build-res/appx/StoreLogo.png" \
123
"${pkgdir}/usr/share/pixmaps/${pkgname}.png"
124
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
125
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
126
}
127
Changes since previous scan
--- PKGBUILD @ 2026-09-17 00:27+++ PKGBUILD @ 2026-09-17 07:25@@ -1,17 +1,17 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> # Contributor: Zaoqi pkgname=electerm-pkgver=5.3.26+pkgver=5.5.15 _electronversion=42 _nodeversion=24 pkgrel=1-pkgdesc="Terminal/ssh/telnet/serialport/sftp client.(Use system-wide electron)"+pkgdesc="đź“»Free and open-sourced terminal/ssh/sftp/ftp/telnet/serialport/RDP/VNC/Spice client." arch=( 'aarch64' 'armv7h' 'x86_64' )-url="https://electerm.html5beta.com/"+url="https://electerm.org/" _ghurl="https://github.com/electerm/electerm" license=('MIT') conflicts=("${pkgname}")@@ -33,7 +33,7 @@ "${pkgname}-${pkgver}::git+${_ghurl}#tag=v${pkgver}" "${pkgname}.sh" )-sha256sums=('9ad3d1c4fce4992b5c18351a7eb6816b841f69efa684f45e481158f7e26abdf4'+sha256sums=('ecf021f141b65d7fbc69724345d5feed664b152431072323a7725cab07953da4' 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d') _ensure_local_nvm() { local NVM_DIR="${srcdir}/.nvm"@@ -45,21 +45,22 @@ find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1 } _set_build_env() {- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"- export ELECTRON_SKIP_BINARY_DOWNLOAD=1- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"- export HOME="${srcdir}/.electron-gyp"- export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"- export NPM_CONFIG_MAXSOCKETS=32- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then- {- export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"- export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"- export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"- }- find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +- fi+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1+ _ev="$(electron${_electronversion} -v)"+ export SYSTEM_ELECTRON_VERSION="${_ev#v}"+ export HOME="${srcdir}/.electron-gyp"+ export XDG_CACHE_HOME="${srcdir}/.cache"+ export XDG_CONFIG_HOME="${srcdir}/.config"+ export XDG_DATA_HOME="${srcdir}/.local/share"+ export npm_config_cache="${srcdir}/.npm_cache"+ export npm_config_maxsockets=32+ export npm_config_audit=false+ export npm_config_fund=false+ export npm_config_progress=false+ export NODE_OPTIONS="--max-old-space-size=4096"+ export npm_config_node_options="--max-old-space-size=4096" } _get_electron_version() { _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 07:25:15 | Medium | 1 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 03:13:17 | Medium | 1 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |