emerald-legacy-launcher
MEDIUM
maintainer AntiApple4life
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The PKGBUILD runs 'pnpm add esbuild' during build, installing an undeclared external npm package from an unverified source, creating a supply-chain risk if the package is compromised.
Triggered rules
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:27
pnpm add esbuild --allow-build=esbuild
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD runs 'pnpm add esbuild' during build, installing an undeclared external npm package from an unverified source, creating a supply-chain risk if the package is compromised.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: AntiApple4life <antiapple@antiapple.net>
2
pkgname=emerald-legacy-launcher
3
pkgver=1.6.1
4
pkgrel=1
5
pkgdesc="FOSS, cross-platform launcher for Minecraft Legacy Console Edition"
6
arch=('x86_64')
7
url="https://github.com/LCE-Hub/LCE-Emerald-Launcher"
8
license=('GPL-3.0')
9
depends=('cairo' 'desktop-file-utils' 'gdk-pixbuf2' 'glib2' 'gtk3' 'hicolor-icon-theme' 'libsoup3' 'pango' 'webkit2gtk-4.1')
10
optdepends=('discord: Discord RPC support')
11
makedepends=('openssl' 'appmenu-gtk-module' 'libappindicator-gtk3' 'librsvg' 'cargo' 'pnpm' 'nodejs')
12
provides=('emerald-legacy-launcher')
13
provides=('emerald-legacy-launcher')
14
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/LCE-Hub/LCE-Emerald-Launcher/archive/refs/tags/v${pkgver}.tar.gz" "no-updater.patch")
15
sha256sums=('32ec9c74965e578b3bf76f458ef5a610de89d26cd9ce8baa5ec771024ac92551'
16
'8aee475faee5f51bb727fc947daa836fa2eb0f137c3313bf01cbf897ac45d7c3')
17
_reponame="LCE-Emerald-Launcher"
18
19
prepare() {
20
patch -d "$srcdir/${_reponame}-${pkgver}" -Np1 -i $srcdir/no-updater.patch
21
}
22
23
24
build() {
25
CFLAGS+=' -ffat-lto-objects'
26
cd "$srcdir/${_reponame}-${pkgver}"
27
pnpm add esbuild --allow-build=esbuild
28
pnpm install
29
pnpm tauri build --bundles=deb
30
}
31
32
package() {
33
cd "$srcdir/${_reponame}-${pkgver}"
34
cp -a src-tauri/target/release/bundle/deb/LCE\ Emerald\ Launcher_${pkgver}_amd64/data/* "${pkgdir}"
35
}
36
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |