fchat-horizon-git
LOW
maintainer wiltedroselie
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npx usage is a fallback for running electron-builder locally after dependencies are installed via pnpm; it executes a project-adjacent tool during build, not an untrusted remote payload.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx usage is a fallback for running electron-builder locally after dependencies are installed via pnpm; it executes a project-adjacent tool during build, not an untrusted remote payload.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:57
npx electron-builder --linux dir -c.electronDist="${_electron_dist}" -c.electronVersion="$(<${_electron_dist}/version)"
PKGBUILD
1 offending line(s) highlighted
1
2
3
_pkgname="fchat-horizon"
4
pkgname="${_pkgname}-git"
5
pkgver=1.36.0.beta.1.r2.g869907f
6
_pkgsrc="Horizon"
7
pkgrel=1
8
pkgdesc="Horizon (F-Chat) Electron client - development snapshot using system Electron runtime"
9
arch=('any')
10
url="https://github.com/Fchat-Horizon/Horizon"
11
license=('MPL-2.0')
12
13
depends=(
14
electron
15
libnotify
16
libsecret
17
libappindicator-gtk3
18
)
19
makedepends=(git nodejs pnpm)
20
optdepends=('xdg-utils: open URLs with default handlers')
21
22
conflicts=( "${_pkgname}" )
23
provides=( "${_pkgname}=${pkgver%%.r*}" 'fchat=3' )
24
25
source=("${_pkgsrc}::git+${url}.git#branch=development")
26
sha256sums=('SKIP')
27
: "${_electron_dist:=/usr/lib/electron}"
28
29
prepare() {
30
cd "${_pkgsrc}"
31
local _electron_version
32
_electron_version="$(<"${_electron_dist}/version")"
33
sed -E -i "s#(\"electron\"[[:space:]]*:[[:space:]]*\")([^\"]+)(\")#\1${_electron_version}\3#" package.json || true
34
sed -E -i "s#(\"electron\"[[:space:]]*:[[:space:]]*\")([^\"]+)(\")#\1${_electron_version}\3#" electron/package.json || true
35
}
36
37
pkgver() {
38
cd "${_pkgsrc}"
39
git describe --long --tags --abbrev=7 2>/dev/null \
40
| sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' \
41
|| printf '0.r%s.%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
42
}
43
44
build() {
45
export HOME="${srcdir}/.home"
46
export XDG_CACHE_HOME="${srcdir}/.cache"
47
export XDG_CONFIG_HOME="${srcdir}/.config"
48
export XDG_DATA_HOME="${srcdir}/.data"
49
export XDG_STATE_HOME="${srcdir}/.state"
50
51
cd "${_pkgsrc}"
52
pnpm install --frozen-lockfile || pnpm install
53
cd electron
54
pnpm install --frozen-lockfile || pnpm install
55
pnpm run webpack:prod
56
pnpm -c exec "electron-builder --linux dir -c.electronDist=${_electron_dist} -c.electronVersion=$(<${_electron_dist}/version)" || \
57
npx electron-builder --linux dir -c.electronDist="${_electron_dist}" -c.electronVersion="$(<${_electron_dist}/version)"
58
}
59
60
package() {
61
cd "${_pkgsrc}/electron"
62
63
install -d "${pkgdir}/usr/lib/${_pkgname}"
64
cp -a dist/linux-unpacked/resources "${pkgdir}/usr/lib/${_pkgname}/"
65
66
install -d "${pkgdir}/usr/bin"
67
cat > "${pkgdir}/usr/bin/${_pkgname}" <<'EOF'
68
#!/bin/bash
69
exec /usr/bin/electron /usr/lib/fchat-horizon/resources/app.asar "$@"
70
EOF
71
chmod 755 "${pkgdir}/usr/bin/${_pkgname}"
72
73
install -d "${pkgdir}/usr/share/applications"
74
cat > "${pkgdir}/usr/share/applications/${_pkgname}.desktop" <<'EOD'
75
[Desktop Entry]
76
Name=Horizon (F-Chat)
77
Comment=The F-Chat Horizon Client (development)
78
Exec=fchat-horizon
79
Terminal=false
80
Type=Application
81
Icon=fchat-horizon
82
Categories=Network;Chat;
83
StartupWMClass=Horizon
84
EOD
85
86
install -d "${pkgdir}/usr/share/pixmaps"
87
install -m644 build/icon.png "${pkgdir}/usr/share/pixmaps/fchat-horizon.png"
88
89
install -Dm644 "${srcdir}/${_pkgsrc}/LICENSE.md" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.md"
90
}
91
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |