electerm-git

LOW
maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The flagged npm install and npx execution are part of building the project from its own source (git repo), using declared dependencies; no external untrusted packages or remote code execution is involved.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged npm install and npx execution are part of building the project from its own source (git repo), using declared dependencies; no external untrusted packages or remote code execution is involved.

2 higher static findings superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:101 npm add -D node-gyp --legacy-peer-deps
Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:111 npx node build/bin/prepare-electron-build.js

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=electerm-git
3pkgver=5.3.26.r50.g27fb979
4_electronversion=42
5_nodeversion=24
6pkgrel=1
7pkgdesc="đź“»Free and open-sourced terminal/ssh/sftp/ftp/telnet/serialport/RDP/VNC/Spice client."
8arch=(
9 'aarch64'
10 'armv7h'
11 'x86_64'
12)
13url="https://electerm.html5beta.com/"
14_ghurl="https://github.com/electerm/electerm"
15license=('MIT')
16conflicts=("${pkgname%-git}")
17provides=("${pkgname%-git}=${pkgver%.r*}")
18depends=(
19 "electron${_electronversion}"
20 'nodejs'
21)
22makedepends=(
23 'npm'
24 'git'
25 'nvm'
26 'gendesk'
27 'python-setuptools'
28 'curl'
29 'yarn'
30 'jq'
31)
32source=(
33 "${pkgname//-/.}::git+${_ghurl}.git"
34 "${pkgname%-git}.sh"
35)
36sha256sums=('SKIP'
37 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
38pkgver() {
39 cd "${srcdir}/${pkgname//-/.}"
40 set -o pipefail
41 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
42 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
43}
44_ensure_local_nvm() {
45 local NVM_DIR="${srcdir}/.nvm"
46 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
47 nvm install "${_nodeversion}"
48 nvm use "${_nodeversion}"
49}
50_get_app_dir() {
51 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
52}
53_set_build_env() {
54 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
55 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
56 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
57 export WORKFLOW_NAME="local-build"
58 _ev="$(electron${_electronversion} -v)"
59 export SYSTEM_ELECTRON_VERSION="${_ev#v}"
60 export HOME="${srcdir}/.electron-gyp"
61 export XDG_CACHE_HOME="${srcdir}/.cache"
62 export XDG_CONFIG_HOME="${srcdir}/.config"
63 export XDG_DATA_HOME="${srcdir}/.local/share"
64 export npm_config_cache="${srcdir}/.npm_cache"
65 export npm_config_maxsockets=32
66 export npm_config_audit=false
67 export npm_config_fund=false
68 export npm_config_progress=false
69 export NODE_OPTIONS="--max-old-space-size=4096"
70 export npm_config_node_options="--max-old-space-size=4096"
71}
72_get_electron_version() {
73 _elec_ver=$(find "${srcdir}" -name "package.json" -exec jq -r \
74 '(.devDependencies.electron // .dependencies.electron) | select(. != null)' \
75 {} + 2>/dev/null | head -n 1)
76 _elec_ver=$(echo "${_elec_ver}" | sed 's/[^0-9.]//g')
77 _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
78 echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
79}
80prepare() {
81 cd "${srcdir}/${pkgname//-/.}"
82 _get_electron_version
83 sed -i -e "
84 s/@electronversion@/${_electronversion}/g
85 s/@appname@/${pkgname%-git}/g
86 s/@runname@/app.asar/g
87 s/@cfgdirname@/${pkgname%-git}/g
88 s/@options@//g
89 " "${srcdir}/${pkgname%-git}.sh"
90 gendesk -q -f -n \
91 --pkgname="${pkgname%-git}" \
92 --pkgdesc="${pkgdesc}" \
93 --categories="System" \
94 --name="${pkgname%-git}" \
95 --exec="${pkgname%-git} %U"
96 _set_build_env
97 _ensure_local_nvm
98 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/" package.json
99 export NODE_ENV=development
100 npm install --legacy-peer-deps
101 npm add -D node-gyp --legacy-peer-deps
102}
103build() {
104 cd "${srcdir}/${pkgname//-/.}"
105 _set_build_env
106 _ensure_local_nvm
107 export NODE_ENV=production
108 npm run clean
109 npm run compile
110 npm run prepare-file
111 npx node build/bin/prepare-electron-build.js
112 npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.json"
113 local _app_dir=$(_get_app_dir)
114 rm -rf \
115 "${_app_dir}/resources/default_app.asar" \
116 "${_app_dir}/resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/prebuilds/"{android-*,darwin-*,win32-*} \
117 "${_app_dir}/resources/app.asar.unpacked/node_modules/font-list/libs/"{darwin,win32}
118}
119package() {
120 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
121 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
122 local _app_dir=$(_get_app_dir)
123 cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-git}/"
124 install -Dm644 "${srcdir}/${pkgname//-/.}/node_modules/@${pkgname%-git}/${pkgname%-git}-resource/build-res/appx/StoreLogo.png" \
125 "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
126 install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
127 install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
128}

Changes since previous scan

--- PKGBUILD @ 2026-09-11 00:19
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,10 +1,10 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=electerm-git
-pkgver=5.1.6.r0.gae619e3
+pkgver=5.3.26.r50.g27fb979
_electronversion=42
_nodeversion=24
pkgrel=1
-pkgdesc="Terminal/ssh/telnet/serialport/sftp client.(Use system-wide electron)"
+pkgdesc="đź“»Free and open-sourced terminal/ssh/sftp/ftp/telnet/serialport/RDP/VNC/Spice client."
arch=(
'aarch64'
'armv7h'
@@ -17,7 +17,7 @@
provides=("${pkgname%-git}=${pkgver%.r*}")
depends=(
"electron${_electronversion}"
- 'python'
+ 'nodejs'
)
makedepends=(
'npm'
@@ -51,21 +51,23 @@
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
}
_set_build_env() {
- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- export HOME="${srcdir}/.electron-gyp"
- export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
- export NPM_CONFIG_MAXSOCKETS=32
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
- export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
- }
- find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
- fi
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export WORKFLOW_NAME="local-build"
+ _ev="$(electron${_electronversion} -v)"
+ export SYSTEM_ELECTRON_VERSION="${_ev#v}"
+ export HOME="${srcdir}/.electron-gyp"
+ export XDG_CACHE_HOME="${srcdir}/.cache"
+ export XDG_CONFIG_HOME="${srcdir}/.config"
+ export XDG_DATA_HOME="${srcdir}/.local/share"
+ export npm_config_cache="${srcdir}/.npm_cache"
+ export npm_config_maxsockets=32
+ export npm_config_audit=false
+ export npm_config_fund=false
+ export npm_config_progress=false
+ export NODE_OPTIONS="--max-old-space-size=4096"
+ export npm_config_node_options="--max-old-space-size=4096"
}
_get_electron_version() {
_elec_ver=$(find "${srcdir}" -name "package.json" -exec jq -r \
@@ -94,17 +96,25 @@
_set_build_env
_ensure_local_nvm
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/" package.json
- NODE_ENV=development npm install --legacy-peer-deps
- NODE_ENV=development npm add -D node-gyp
+ export NODE_ENV=development
+ npm install --legacy-peer-deps
+ npm add -D node-gyp --legacy-peer-deps
}
build() {
cd "${srcdir}/${pkgname//-/.}"
_set_build_env
_ensure_local_nvm
- NODE_ENV=production npm run clean
- NODE_ENV=production npm run compile
- NODE_ENV=production npm run prepare-file
- NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.json"
+ export NODE_ENV=production
+ npm run clean
+ npm run compile
+ npm run prepare-file
+ npx node build/bin/prepare-electron-build.js
+ npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.json"
+ local _app_dir=$(_get_app_dir)
+ rm -rf \
+ "${_app_dir}/resources/default_app.asar" \
+ "${_app_dir}/resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/prebuilds/"{android-*,darwin-*,win32-*} \
+ "${_app_dir}/resources/app.asar.unpacked/node_modules/font-list/libs/"{darwin,win32}
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
@@ -116,4 +126,3 @@
install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
-

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 3
2026-09-16 00:03:17 Low 3
2026-09-15 00:25:31 Low 3
2026-09-14 00:27:57 Low 3
2026-09-13 00:19:54 Low 3
2026-09-12 00:25:17 Low 3
2026-09-11 01:21:31 Medium 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion