etcher-git

maintainer zxp19821005 · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npm install runs within the project's own source tree from a git checkout of the official repository, which is a normal part of building the application; the flagged 'external package' install refers to development dependencies added via npm add, which is part of standard build tooling and not an arbitrary remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npm install runs within the project's own source tree from a git checkout of the official repository, which is a normal part of building the application; the flagged 'external package' install refers to development dependencies added via npm add, which is part of standard build tooling and not an arbitrary remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:92 NODE_ENV=development npm add -D @electron-forge/plugin-local-electron

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Contributor: Yurii Kolesnykov <root@yurikoles.com>
    
      3# based on aur/balena-etcher: Matthew McGinn <mamcgi@gmail.com>
    
      4pkgname=etcher-git
    
      5_pkgname=balenaEtcher
    
      6pkgver=2.1.5.r0.gd1dab67
    
      7_electronversion=37
    
      8_nodeversion=20
    
      9pkgrel=1
    
      10pkgdesc='Flash OS images to SD cards & USB drives, safely and easily'
    
      11arch=('any')
    
      12url='https://etcher.io/'
    
      13_ghurl="https://github.com/balena-io/etcher"
    
      14license=("Apache-2.0")
    
      15conflicts=(
    
      16    "${pkgname%-git}"
    
      17    "balena-${pkgname%-git}"
    
      18    "balena-${pkgname%-git}-electron"
    
      19    "${pkgname%-git}-ng"
    
      20)
    
      21provides=("${pkgname%-git}=${pkgver%.r*}")
    
      22depends=(
    
      23    "electron${_electronversion}"
    
      24)
    
      25makedepends=(
    
      26    'npm'
    
      27    'git'
    
      28    'nvm'
    
      29    'gendesk'
    
      30    'curl'
    
      31    'jq'
    
      32)
    
      33source=(
    
      34    "${pkgname%-git}.git::git+${_ghurl}.git"
    
      35    "${pkgname%-git}.sh"
    
      36)
    
      37sha256sums=('SKIP'
    
      38            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      39pkgver() {
    
      40    cd "${srcdir}/${pkgname//-/.}"
    
      41    set -o pipefail
    
      42    git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
      43    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      44}
    
      45_ensure_local_nvm() {
    
      46    local NVM_DIR="${srcdir}/.nvm"
    
      47    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      48    nvm install "${_nodeversion}"
    
      49    nvm use "${_nodeversion}"
    
      50}
    
      51_get_electron_version() {
    
      52    _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
    
      53        -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
    
      54    [[ -z "${_elec_ver}" ]] && return 1
    
      55    echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
    
      56}
    
      57prepare() {
    
      58    cd "${srcdir}/${pkgname%-git}.git"
    
      59    _get_electron_version
    
      60    sed -i -e "
    
      61        s/@electronversion@/${_electronversion}/g
    
      62        s/@appname@/${pkgname%-git}/g
    
      63        s/@runname@/app.asar/g
    
      64        s/@cfgdirname@/${pkgname%-git}/g
    
      65    " "${srcdir}/${pkgname%-git}.sh"
    
      66    gendesk -q -f -n \
    
      67        --pkgname="${pkgname%-git}" \
    
      68        --pkgdesc="${pkgdesc}" \
    
      69        --categories="Utility" \
    
      70        --name="${_pkgname}" \
    
      71        --exec="${pkgname%-git} %U"
    
      72    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      73    export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
      74    local HOME="${srcdir}/.electron-gyp"
    
      75    export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
    
      76    export NPM_CONFIG_MAXSOCKETS=32
    
      77    if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      78        {
    
      79            export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
    
      80            export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
    
      81            export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
    
      82            export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
    
      83            export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
    
      84            export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
    
      85        }
    
      86        find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
    
      87    fi
    
      88    _ensure_local_nvm
    
      89    sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
      90    npm cache clean --force
    
      91    NODE_ENV=development    npm install --legacy-peer-deps
    
      92    NODE_ENV=development    npm add -D @electron-forge/plugin-local-electron
    
      93}
    
      94build() {
    
      95    cd "${srcdir}/${pkgname%-git}.git"
    
      96    _ensure_local_nvm
    
      97    local electronDist="/usr/lib/electron${_electronversion}"
    
      98	sed -i -e "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
    
      99    {\\
    
      100        name: \"@electron-forge/plugin-local-electron\",\\
    
      101        config: {\\
    
      102            electronPath: \"${electronDist}\"\\
    
      103        }\\
    
      104    }," forge.config.*
    
      105    NODE_ENV=production     npm run package
    
      106}
    
      107package() {
    
      108    install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
      109    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
    
      110    local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -exec dirname {} + | head -n 1)
    
      111    cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
    
      112    _icon_sizes=(16x16 32x32 48x48 128x128 256x256 512x512)
    
      113    for _icons in "${_icon_sizes[@]}";do
    
      114        install -Dm644 "${srcdir}/${pkgname%-git}.git/assets/iconset/${_icons}.png" \
    
      115            "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
    
      116    done
    
      117    install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
      118    install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      119}
    
      120

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2