exifcleaner

LOW
maintainer zxp19821005 0 votes scanned 2026-10-21 07:31:05.029830
View on AUR
Why flagged

The package builds from a legitimate project source on GitHub, uses standard Node.js and Yarn workflows, and installs dependencies dynamically named by variables but from trusted npm/yarn registries; no evidence of malicious behavior or untrusted code execution.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a legitimate project source on GitHub, uses standard Node.js and Yarn workflows, and installs dependencies dynamically named by variables but from trusted npm/yarn registries; no evidence of malicious behavior or untrusted code execution.

  • PKGBUILD:90 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=exifcleaner
3_pkgname=ExifCleaner
4pkgver=4.6.0
5_electronversion=43
6_nodeversion=22
7pkgrel=1
8pkgdesc="Clean metadata from images, videos, PDFs, and other files."
9arch=('any')
10url="https://exifcleaner.com/"
11_ghurl="https://github.com/szTheory/exifcleaner"
12license=('MIT')
13depends=(
14 "electron${_electronversion}"
15 'perl'
16)
17makedepends=(
18 'npm'
19 'nvm'
20 'git'
21 'yarn'
22 'jq'
23)
24source=(
25 "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
26 "resources-path-override.js"
27 "${pkgname}.sh"
28)
29sha256sums=('56dfb279ae8d9dbb96dad4baa4ef2424ad1e42668d9da6ba829cb7910ebeecc3'
30 '7860b52642f7f9cac7341253149e5ac9b75deb338c2cf507c90e49a05d3adeb8'
31 '523a9e7294fb8d0611611db823288e3dc38ae021eceb3067791dc0c4ff3b0d15')
32_get_project_dir() {
33 local d
34 while IFS= read -r d; do
35 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
36 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
37}
38_ensure_local_nvm() {
39 local NVM_DIR="${srcdir}/.nvm"
40 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
41 nvm install "${_nodeversion}"
42 nvm use "${_nodeversion}"
43}
44_get_app_dir() {
45 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
46 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
47}
48_get_electron_version() {
49 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
50 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
51 | grep -oE '[0-9]+' | head -1)
52 [[ -z "${_elec_ver}" ]] && return 1
53 (( _elec_ver == _electronversion )) && c=32 || c=31
54 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
55}
56_set_build_env() {
57 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
58 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
59 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
60 export ELECTRON_BUILDER_OFFLINE=true
61 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
62 export HOME="${srcdir}/.home"
63 export XDG_CACHE_HOME="${HOME}/.cache"
64 export XDG_CONFIG_HOME="${HOME}/.config"
65 export XDG_DATA_HOME="${HOME}/.local/share"
66 export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
67 export YARN_NETWORK_CONCURRENCY=32
68 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
69 export COREPACK_HOME="${HOME}/.corepack"
70 export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
71 local _yarnver _yarnmajor=0
72 _yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"
73 _yarnmajor="${_yarnver%%.*}"
74 _yarnmajor="${_yarnmajor:-0}"
75 if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
76 export XDG_STATE_HOME="${HOME}/.local/state"
77 export YARN_ENABLE_GLOBAL_CACHE=false
78 export YARN_ENABLE_MIRROR=false
79 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
80 export YARN_NODE_LINKER=node-modules
81 export YARN_NM_MODE=hardlinks-local
82 export YARN_ENABLE_TELEMETRY=false
83 export YARN_ENABLE_SCRIPTS=true
84 export YARN_HTTP_TIMEOUT=600000
85 export YARN_HTTP_RETRY=5
86 export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
87 local _yarnhome="${HOME}/.yarn/install"
88 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
89 if [[ -n "${_yarnver}" ]]; then
90 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
91 export PATH="${_yarnhome}/bin:${PATH}"
92 fi
93 else
94 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
95 export YARN_LINK_FOLDER="${HOME}/.yarn/link"
96 export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
97 export YARN_NETWORK_TIMEOUT=600000
98 export YARN_CHILD_CONCURRENCY="$(nproc)"
99 export YARN_FROZEN_LOCKFILE=true
100 export YARN_IGNORE_ENGINES=true
101 export YARN_PRODUCTION=false
102 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
103 fi
104 local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
105 export YARN_REGISTRY="${_reg}"
106 _reg="${_reg%/}"
107 if [[ -f .yarnrc ]]; then
108 sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
109 fi
110 if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
111 sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
112 fi
113}
114prepare() {
115 cd "$(_get_project_dir)"
116 _get_electron_version
117 sed -i -e "
118 s/@electronversion@/${_electronversion}/g
119 s/@appname@/${pkgname}/g
120 " "${srcdir}/${pkgname}.sh" "${srcdir}/resources-path-override.js"
121 gendesk -q -f -n \
122 --pkgname="${pkgname}" \
123 --pkgdesc="${pkgdesc}" \
124 --categories="Graphics;Utility" \
125 --name="${_pkgname}" \
126 --exec="${pkgname} %U"
127 _ensure_local_nvm
128 _set_build_env
129 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
130 export NODE_ENV=development
131 yarn install
132}
133build() {
134 cd "$(_get_project_dir)"
135 _ensure_local_nvm
136 _set_build_env
137 export NODE_ENV=production
138 yarn compile
139 yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
140 local _archrem=$([[ "${CARCH}" == "aarch64" ]] && echo x64 || echo arm)
141 find "$(_get_app_dir)" -type d \
142 \( -name '*darwin*' -o -name '*android*' -o -name 'win32*' -o -name "*ia32*" -o -name "*${_archrem}*" \) \
143 -prune -exec rm -rf {} +
144 rm -rf "$(_get_app_dir)/resources/default_app.asar"
145}
146package() {
147 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
148 install -Dm644 "${srcdir}/resources-path-override.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
149 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
150 install -Dm644 "$(_get_project_dir)/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
151 install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
152 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
153}
154

Changes since previous scan

--- PKGBUILD @ 2026-09-29 03:22
+++ PKGBUILD @ 2026-10-21 07:31
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=exifcleaner
_pkgname=ExifCleaner
-pkgver=4.5.0
+pkgver=4.6.0
_electronversion=43
_nodeversion=22
pkgrel=1
@@ -23,10 +23,12 @@
)
source=(
"${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
+ "resources-path-override.js"
"${pkgname}.sh"
)
-sha256sums=('b9c881014fa5d7fb4240d308cd1573216b4d92b3acb7cf3a46a994a7887cde57'
- 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+sha256sums=('56dfb279ae8d9dbb96dad4baa4ef2424ad1e42668d9da6ba829cb7910ebeecc3'
+ '7860b52642f7f9cac7341253149e5ac9b75deb338c2cf507c90e49a05d3adeb8'
+ '523a9e7294fb8d0611611db823288e3dc38ae021eceb3067791dc0c4ff3b0d15')
_get_project_dir() {
local d
while IFS= read -r d; do
@@ -34,20 +36,22 @@
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_get_electron_version() {
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
| xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
- | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ | grep -oE '[0-9]+' | head -1)
[[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
@@ -65,7 +69,7 @@
export COREPACK_HOME="${HOME}/.corepack"
export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
local _yarnver _yarnmajor=0
- _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
+ _yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"
_yarnmajor="${_yarnver%%.*}"
_yarnmajor="${_yarnmajor:-0}"
if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
@@ -80,7 +84,12 @@
export YARN_HTTP_TIMEOUT=600000
export YARN_HTTP_RETRY=5
export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
- mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}"
+ local _yarnhome="${HOME}/.yarn/install"
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
+ if [[ -n "${_yarnver}" ]]; then
+ npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
+ export PATH="${_yarnhome}/bin:${PATH}"
+ fi
else
export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
export YARN_LINK_FOLDER="${HOME}/.yarn/link"
@@ -93,6 +102,7 @@
mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
fi
local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
+ export YARN_REGISTRY="${_reg}"
_reg="${_reg%/}"
if [[ -f .yarnrc ]]; then
sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
@@ -105,11 +115,9 @@
cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
- s/@electronversion@/${_electronversion}/g
- s/@appname@/${pkgname}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${_pkgname}/g
- " "${srcdir}/${pkgname}.sh"
+ s/@electronversion@/${_electronversion}/g
+ s/@appname@/${pkgname}/g
+ " "${srcdir}/${pkgname}.sh" "${srcdir}/resources-path-override.js"
gendesk -q -f -n \
--pkgname="${pkgname}" \
--pkgdesc="${pkgdesc}" \
@@ -118,8 +126,7 @@
--exec="${pkgname} %U"
_ensure_local_nvm
_set_build_env
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- find src -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname}\'/g" {} +
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
export NODE_ENV=development
yarn install
}
@@ -130,24 +137,18 @@
export NODE_ENV=production
yarn compile
yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
- local _app_dir="$(_get_app_dir)"
- find "${_app_dir}/resources" -type d -exec chmod 755 {} +
- case "${CARCH}" in
- aarch64) _archrem=x64 ;;
- x86_64) _archrem=arm ;;
- esac
- find "${_app_dir}/resources/app.asar.unpacked" -type d \
- \( -name "darwin*" -o -name "win32*" -o -name "*${_archrem}"* \) \
- -exec rm -rf {} +
+ local _archrem=$([[ "${CARCH}" == "aarch64" ]] && echo x64 || echo arm)
+ find "$(_get_app_dir)" -type d \
+ \( -name '*darwin*' -o -name '*android*' -o -name 'win32*' -o -name "*ia32*" -o -name "*${_archrem}*" \) \
+ -prune -exec rm -rf {} +
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
- install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _app_dir="$(_get_app_dir)"
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
- rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
- local _src="$(_get_project_dir)"
- install -Dm644 "${_src}/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
- install -Dm644 "${_src}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${srcdir}/resources-path-override.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
+ install -Dm644 "$(_get_project_dir)/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
+ install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-10-21 07:31:05 Low 1
2026-09-29 03:22:52 Clean 0
2026-09-20 05:32:24 Clean 0
2026-08-24 01:21:42 Clean 0
2026-08-13 00:17:07 Clean 0
2026-08-12 00:27:08 Low 2
2026-08-11 00:07:57 Low 2
2026-08-10 00:09:14 Low 2
2026-08-09 00:07:45 Low 2
2026-08-08 00:18:14 Low 2
2026-08-07 00:19:04 Low 2
2026-08-06 00:26:13 Low 2
2026-08-05 00:12:14 Low 2
2026-08-04 00:01:00 Low 2
2026-08-03 00:08:14 Low 2
2026-08-02 00:16:08 Low 2
2026-08-01 00:11:18 Low 2
2026-07-31 00:14:10 Low 2
2026-07-30 00:17:23 Low 2
2026-07-29 05:10:22 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion