fchat-horizon-git

maintainer wiltedroselie · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx usage is a fallback for running electron-builder locally after dependencies are installed via pnpm; it executes a project-adjacent tool during build, not an untrusted remote payload.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx usage is a fallback for running electron-builder locally after dependencies are installed via pnpm; it executes a project-adjacent tool during build, not an untrusted remote payload.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:57 npx electron-builder --linux dir -c.electronDist="${_electron_dist}" -c.electronVersion="$(<${_electron_dist}/version)"

PKGBUILD

1 offending line(s) highlighted

      1
    
      2
    
      3_pkgname="fchat-horizon"
    
      4pkgname="${_pkgname}-git"
    
      5pkgver=1.36.0.beta.1.r2.g869907f
    
      6_pkgsrc="Horizon"
    
      7pkgrel=1
    
      8pkgdesc="Horizon (F-Chat) Electron client - development snapshot using system Electron runtime"
    
      9arch=('any')
    
      10url="https://github.com/Fchat-Horizon/Horizon"
    
      11license=('MPL-2.0')
    
      12
    
      13depends=(
    
      14  electron
    
      15  libnotify
    
      16  libsecret
    
      17  libappindicator-gtk3
    
      18)
    
      19makedepends=(git nodejs pnpm)
    
      20optdepends=('xdg-utils: open URLs with default handlers')
    
      21
    
      22conflicts=( "${_pkgname}" )
    
      23provides=( "${_pkgname}=${pkgver%%.r*}" 'fchat=3' )
    
      24
    
      25source=("${_pkgsrc}::git+${url}.git#branch=development")
    
      26sha256sums=('SKIP')
    
      27: "${_electron_dist:=/usr/lib/electron}"
    
      28
    
      29prepare() {
    
      30  cd "${_pkgsrc}"
    
      31  local _electron_version
    
      32  _electron_version="$(<"${_electron_dist}/version")"
    
      33  sed -E -i "s#(\"electron\"[[:space:]]*:[[:space:]]*\")([^\"]+)(\")#\1${_electron_version}\3#" package.json || true
    
      34  sed -E -i "s#(\"electron\"[[:space:]]*:[[:space:]]*\")([^\"]+)(\")#\1${_electron_version}\3#" electron/package.json || true
    
      35}
    
      36
    
      37pkgver() {
    
      38  cd "${_pkgsrc}"
    
      39  git describe --long --tags --abbrev=7 2>/dev/null \
    
      40    | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' \
    
      41    || printf '0.r%s.%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      42}
    
      43
    
      44build() {
    
      45  export HOME="${srcdir}/.home"
    
      46  export XDG_CACHE_HOME="${srcdir}/.cache"
    
      47  export XDG_CONFIG_HOME="${srcdir}/.config"
    
      48  export XDG_DATA_HOME="${srcdir}/.data"
    
      49  export XDG_STATE_HOME="${srcdir}/.state"
    
      50
    
      51  cd "${_pkgsrc}"
    
      52  pnpm install --frozen-lockfile || pnpm install
    
      53  cd electron
    
      54  pnpm install --frozen-lockfile || pnpm install
    
      55  pnpm run webpack:prod
    
      56  pnpm -c exec "electron-builder --linux dir -c.electronDist=${_electron_dist} -c.electronVersion=$(<${_electron_dist}/version)" || \
    
      57    npx electron-builder --linux dir -c.electronDist="${_electron_dist}" -c.electronVersion="$(<${_electron_dist}/version)"
    
      58}
    
      59
    
      60package() {
    
      61  cd "${_pkgsrc}/electron"
    
      62
    
      63  install -d "${pkgdir}/usr/lib/${_pkgname}"
    
      64  cp -a dist/linux-unpacked/resources "${pkgdir}/usr/lib/${_pkgname}/"
    
      65
    
      66  install -d "${pkgdir}/usr/bin"
    
      67  cat > "${pkgdir}/usr/bin/${_pkgname}" <<'EOF'
    
      68#!/bin/bash
    
      69exec /usr/bin/electron /usr/lib/fchat-horizon/resources/app.asar "$@"
    
      70EOF
    
      71  chmod 755 "${pkgdir}/usr/bin/${_pkgname}"
    
      72
    
      73  install -d "${pkgdir}/usr/share/applications"
    
      74  cat > "${pkgdir}/usr/share/applications/${_pkgname}.desktop" <<'EOD'
    
      75[Desktop Entry]
    
      76Name=Horizon (F-Chat)
    
      77Comment=The F-Chat Horizon Client (development)
    
      78Exec=fchat-horizon
    
      79Terminal=false
    
      80Type=Application
    
      81Icon=fchat-horizon
    
      82Categories=Network;Chat;
    
      83StartupWMClass=Horizon
    
      84EOD
    
      85
    
      86  install -d "${pkgdir}/usr/share/pixmaps"
    
      87  install -m644 build/icon.png "${pkgdir}/usr/share/pixmaps/fchat-horizon.png"
    
      88
    
      89  install -Dm644 "${srcdir}/${_pkgsrc}/LICENSE.md" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.md"
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2