emerald-legacy-launcher

MEDIUM

maintainer AntiApple4life 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD runs 'pnpm add esbuild' during build, installing an undeclared external npm package from an unverified source, creating a supply-chain risk if the package is compromised.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:27 pnpm add esbuild --allow-build=esbuild

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD runs 'pnpm add esbuild' during build, installing an undeclared external npm package from an unverified source, creating a supply-chain risk if the package is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AntiApple4life <antiapple@antiapple.net>
    
      2pkgname=emerald-legacy-launcher
    
      3pkgver=1.6.1
    
      4pkgrel=1
    
      5pkgdesc="FOSS, cross-platform launcher for Minecraft Legacy Console Edition"
    
      6arch=('x86_64')
    
      7url="https://github.com/LCE-Hub/LCE-Emerald-Launcher"
    
      8license=('GPL-3.0')
    
      9depends=('cairo' 'desktop-file-utils' 'gdk-pixbuf2' 'glib2' 'gtk3' 'hicolor-icon-theme' 'libsoup3' 'pango' 'webkit2gtk-4.1')
    
      10optdepends=('discord: Discord RPC support')
    
      11makedepends=('openssl' 'appmenu-gtk-module' 'libappindicator-gtk3' 'librsvg' 'cargo' 'pnpm' 'nodejs')
    
      12provides=('emerald-legacy-launcher')
    
      13provides=('emerald-legacy-launcher')
    
      14source=("${pkgname}-${pkgver}.tar.gz::https://github.com/LCE-Hub/LCE-Emerald-Launcher/archive/refs/tags/v${pkgver}.tar.gz" "no-updater.patch")
    
      15sha256sums=('32ec9c74965e578b3bf76f458ef5a610de89d26cd9ce8baa5ec771024ac92551'
    
      16            '8aee475faee5f51bb727fc947daa836fa2eb0f137c3313bf01cbf897ac45d7c3')
    
      17_reponame="LCE-Emerald-Launcher"
    
      18
    
      19prepare() {
    
      20    patch -d "$srcdir/${_reponame}-${pkgver}" -Np1 -i $srcdir/no-updater.patch
    
      21}
    
      22
    
      23
    
      24build() {
    
      25  CFLAGS+=' -ffat-lto-objects'
    
      26  cd "$srcdir/${_reponame}-${pkgver}"
    
      27  pnpm add esbuild --allow-build=esbuild
    
      28  pnpm install
    
      29  pnpm tauri build --bundles=deb
    
      30}
    
      31
    
      32package() {
    
      33  cd "$srcdir/${_reponame}-${pkgver}"
    
      34  cp -a src-tauri/target/release/bundle/deb/LCE\ Emerald\ Launcher_${pkgver}_amd64/data/* "${pkgdir}"
    
      35}
    
      36

Changes since previous scan

--- PKGBUILD @ 2026-09-06 00:17
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,6 +1,6 @@
 # Maintainer: AntiApple4life <antiapple@antiapple.net>
 pkgname=emerald-legacy-launcher
-pkgver=1.6.0
+pkgver=1.6.1
 pkgrel=1
 pkgdesc="FOSS, cross-platform launcher for Minecraft Legacy Console Edition"
 arch=('x86_64')
@@ -12,7 +12,7 @@
 provides=('emerald-legacy-launcher')
 provides=('emerald-legacy-launcher')
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/LCE-Hub/LCE-Emerald-Launcher/archive/refs/tags/v${pkgver}.tar.gz" "no-updater.patch")
-sha256sums=('0a32ab5f411715a1486292d384a69a0f0508358d7fe84b87dca258031ba09f17'
+sha256sums=('32ec9c74965e578b3bf76f458ef5a610de89d26cd9ce8baa5ec771024ac92551'
             '8aee475faee5f51bb727fc947daa836fa2eb0f137c3313bf01cbf897ac45d7c3')
 _reponame="LCE-Emerald-Launcher"
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 02:02:01	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2