flawless-cut

LOW

maintainer nadir 0 votes scanned 2026-10-18 09:25:03.798113

View on AUR

Why flagged

The npx call runs electron-builder from the locally installed node_modules (installed via npm install from the project's own package.json), not a remote package fetched at runtime; the source tarball is from the project's own GitHub repo with a checksum, so this is a normal Electron app build with no obfuscated payloads or exfiltration, though npm install without a lockfile introduces supply-chain uncertainty.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The npx call runs electron-builder from the locally installed node_modules (installed via npm install from the project's own package.json), not a remote package fetched at runtime; the source tarball is from the project's own GitHub repo with a checksum, so this is a normal Electron app build with no obfuscated payloads or exfiltration, though npm install without a lockfile introduces supply-chain uncertainty.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:56 npx electron-builder --dir -l

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nadir <nadir@localhost>
    
      2# Upstream: https://github.com/metadream/flawless-cut
    
      3
    
      4pkgname=flawless-cut
    
      5pkgver=1.2.2
    
      6pkgrel=1
    
      7pkgdesc="Fast, lossless video cutter and merger"
    
      8arch=(x86_64)
    
      9url="https://github.com/metadream/flawless-cut"
    
      10license=(MIT)
    
      11
    
      12# libudev.so.1 is provided by systemd (Arch) or elogind/libudev (Artix);
    
      13# both are present on any desktop install, so it is not listed explicitly.
    
      14depends=(
    
      15    alsa-lib          # libasound.so.2
    
      16    at-spi2-core      # libatk-bridge-2.0.so.0, libatspi.so.0
    
      17    avahi             # libavahi-client (runtime)
    
      18    cairo             # libcairo.so.2
    
      19    cups              # libcups.so.2
    
      20    dbus              # libdbus-1.so.3
    
      21    expat             # libexpat.so.1
    
      22    ffmpeg            # system ffmpeg, replaces the vendored static build
    
      23    glib2             # libglib/gobject/gio-2.0.so.0
    
      24    gtk3              # libgtk-3.so.0 (pulls in atk, pango, gdk-pixbuf)
    
      25    libx11            # libX11.so.6
    
      26    libxcomposite     # libXcomposite.so.1
    
      27    libxcursor        # dlopen'ed by Chromium input handling
    
      28    libxdamage        # libXdamage.so.1
    
      29    libxext           # libXext.so.6
    
      30    libxfixes         # libXfixes.so.3
    
      31    libxi             # dlopen'ed by Chromium input handling
    
      32    libxrandr         # libXrandr.so.2
    
      33    libxtst           # dlopen'ed by Chromium (input injection)
    
      34    libxcb            # libxcb.so.1
    
      35    libxkbcommon      # libxkbcommon.so.0
    
      36    mesa              # libgbm.so.1
    
      37    mediainfo         # system mediainfo, replaces the vendored build
    
      38    nspr              # libnspr4.so
    
      39    nss               # libnss3/nssutil3/smime3.so
    
      40    xdg-utils         # xdg-open for openExternal/openPath
    
      41)
    
      42makedepends=(nodejs)
    
      43
    
      44source=("https://github.com/metadream/flawless-cut/archive/refs/tags/${pkgver}.tar.gz")
    
      45sha256sums=('37d6ca80c9f843124cd3e48fa2342b2172898014d04fe5249dbc9ada13fee47c')
    
      46
    
      47build() {
    
      48    cd "${srcdir}/${pkgname}-${pkgver}"
    
      49
    
      50    # Installs devDependencies (electron, electron-builder);
    
      51    # electron's postinstall downloads the matching runtime binary.
    
      52    # Upstream ships no package-lock.json, so `npm install` is used instead of `npm ci`.
    
      53    npm install --no-audit --no-fund
    
      54
    
      55    # Unpacked app dir: Electron runtime + resources/app.asar + resources/bin
    
      56    npx electron-builder --dir -l
    
      57}
    
      58
    
      59package() {
    
      60    cd "${srcdir}/${pkgname}-${pkgver}"
    
      61
    
      62    install -d "${pkgdir}/opt/${pkgname}"
    
      63    cp -a dist/linux-unpacked/. "${pkgdir}/opt/${pkgname}/"
    
      64
    
      65    # Use the system ffmpeg/mediainfo instead of the vendored static builds
    
      66    rm -f "${pkgdir}/opt/${pkgname}/resources/bin/"{ffmpeg,mediainfo}
    
      67    ln -s /usr/bin/ffmpeg "${pkgdir}/opt/${pkgname}/resources/bin/ffmpeg"
    
      68    ln -s /usr/bin/mediainfo "${pkgdir}/opt/${pkgname}/resources/bin/mediainfo"
    
      69
    
      70    # Arch policy: no setuid binaries in packages. Chromium falls back to the
    
      71    # user-namespace sandbox (unprivileged_userns_clone=1 on Arch/Artix).
    
      72    chmod 0755 "${pkgdir}/opt/${pkgname}/chrome-sandbox"
    
      73
    
      74    install -d "${pkgdir}/usr/bin"
    
      75    ln -s "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      76
    
      77    install -Dm644 assets/build/icon.png \
    
      78        "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
    
      79
    
      80    install -d "${pkgdir}/usr/share/applications"
    
      81    cat > "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<'EOF'
    
      82[Desktop Entry]
    
      83Type=Application
    
      84Name=FlawlessCut
    
      85Comment=Fast, lossless video cutter and merger
    
      86Exec=flawless-cut
    
      87Icon=flawless-cut
    
      88Categories=AudioVideo;VideoEditing;
    
      89Terminal=false
    
      90EOF
    
      91}
    
      92sha256sums=('37d6ca80c9f843124cd3e48fa2342b2172898014d04fe5249dbc9ada13fee47c')
    
      93

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 09:25:03	Low	3
2026-10-18 09:21:55	Medium	2