emerald-legacy-launcher

maintainer AntiApple4life · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The build process runs 'pnpm add esbuild' to install a package not declared in sources or dependencies, creating a supply-chain risk from an unverifiable remote source.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:27 pnpm add esbuild --allow-build=esbuild

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The build process runs 'pnpm add esbuild' to install a package not declared in sources or dependencies, creating a supply-chain risk from an unverifiable remote source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AntiApple4life <antiapple@antiapple.net>
    
      2pkgname=emerald-legacy-launcher
    
      3pkgver=1.5.1
    
      4pkgrel=1
    
      5pkgdesc="FOSS, cross-platform launcher for Minecraft Legacy Console Edition"
    
      6arch=('x86_64')
    
      7url="https://github.com/LCE-Hub/LCE-Emerald-Launcher"
    
      8license=('GPL-3.0')
    
      9depends=('cairo' 'desktop-file-utils' 'gdk-pixbuf2' 'glib2' 'gtk3' 'hicolor-icon-theme' 'libsoup3' 'pango' 'webkit2gtk-4.1')
    
      10optdepends=('discord: Discord RPC support')
    
      11makedepends=('openssl' 'appmenu-gtk-module' 'libappindicator-gtk3' 'librsvg' 'cargo' 'pnpm' 'nodejs')
    
      12provides=('emerald-legacy-launcher')
    
      13provides=('emerald-legacy-launcher')
    
      14source=("${pkgname}-${pkgver}.tar.gz::https://github.com/LCE-Hub/LCE-Emerald-Launcher/archive/refs/tags/v${pkgver}.tar.gz" "no-updater.patch")
    
      15sha256sums=('27dbf8e97de0ab8f6f508f1573e02e970f8dfb06f2a0b1e940f88ab84f90d215'
    
      16            '8aee475faee5f51bb727fc947daa836fa2eb0f137c3313bf01cbf897ac45d7c3')
    
      17_reponame="LCE-Emerald-Launcher"
    
      18
    
      19prepare() {
    
      20    patch -d "$srcdir/${_reponame}-${pkgver}" -Np1 -i $srcdir/no-updater.patch
    
      21}
    
      22
    
      23
    
      24build() {
    
      25  CFLAGS+=' -ffat-lto-objects'
    
      26  cd "$srcdir/${_reponame}-${pkgver}"
    
      27  pnpm add esbuild --allow-build=esbuild
    
      28  pnpm install
    
      29  pnpm tauri build --bundles=deb
    
      30}
    
      31
    
      32package() {
    
      33  cd "$srcdir/${_reponame}-${pkgver}"
    
      34  cp -a src-tauri/target/release/bundle/deb/LCE\ Emerald\ Launcher_${pkgver}_amd64/data/* "${pkgdir}"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2