fluent-reader-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-09-24 01:41:16.165362
View on AUR
Why flagged

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:220 bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=fluent-reader-git
3_pkgname='Fluent Reader'
4pkgver=1.2.2.r3.g5813998
5_electronversion=41
6_nodeversion=24
7pkgrel=1
8pkgdesc="A modern desktop RSS reader."
9arch=('any')
10url="https://hyliu.me/fluent-reader/"
11_ghurl="https://github.com/yang991178/fluent-reader"
12license=("BSD-3-Clause")
13conflicts=("${pkgname%-git}")
14provides=("${pkgname%-git}=${pkgver%.r*}")
15depends=(
16 "electron${_electronversion}"
17)
18makedepends=(
19 'bun'
20 'git'
21 'nvm'
22 'gendesk'
23 'jq'
24)
25source=(
26 "${pkgname%-git}.git::git+${_ghurl}.git"
27 "${pkgname%-git}.sh"
28)
29sha256sums=('SKIP'
30 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
31pkgver() {
32 cd "${srcdir}/${pkgname%-git}.git"
33 set -o pipefail
34 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
35 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
36}
37_ensure_local_nvm() {
38 local NVM_DIR="${srcdir}/.nvm"
39 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
40 nvm install "${_nodeversion}"
41 nvm use "${_nodeversion}"
42}
43_get_app_dir() {
44 find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
45}
46_get_electron_version() {
47 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
48 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
49 [[ -z "${_elec_ver}" ]] && return 1
50 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
51}
52_set_build_env() {
53 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
54 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
55 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
56 export ELECTRON_BUILDER_OFFLINE=true
57 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
58 export HOME="${srcdir}/.home"
59 export XDG_CACHE_HOME="${HOME}/.cache"
60 export XDG_CONFIG_HOME="${HOME}/.config"
61 export XDG_DATA_HOME="${HOME}/.local/share"
62 export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
63 export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
64 export BUN_INSTALL_BIN="${HOME}/.bun/bin"
65 export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
66 export BUN_CONFIG_SKIP_LOAD_LOCKFILE=1
67 export BUN_DISABLE_DOTENV=1
68 export DO_NOT_TRACK=1
69 export BUN_JOBS="$(nproc)"
70 mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
71}
72prepare() {
73 cd "${srcdir}/${pkgname%-git}.git"
74 _get_electron_version
75 sed -i -e "
76 s/@electronversion@/${_electronversion}/g
77 s/@appname@/${pkgname%-git}/g
78 s/@runname@/app.asar/g
79 s/@cfgdirname@/${pkgname%-git}/g
80 " -i "${srcdir}/${pkgname%-git}.sh"
81 gendesk -q -f -n \
82 --pkgname="${pkgname%-git}" \
83 --pkgdesc="${pkgdesc}" \
84 --categories="Utility" \
85 --name="${_pkgname}" \
86 --exec="${pkgname%-git} %U"
87 _ensure_local_nvm
88 _set_build_env
89 sed "s/.\/bin\/\${platform}\/\${arch}\//release/g" -i electron-builder.yml
90 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
91 export NODE_ENV=development
92 # Upgrade React to v17 for jsx-runtime compatibility
93 sed -i 's/"react": "\^16\.[^"]*"/"react": "^17.0.2"/g' package.json
94 sed -i 's/"react-dom": "\^16\.[^"]*"/"react-dom": "^17.0.2"/g' package.json
95 sed -i 's/"@types\/react": "\^16\.[^"]*"/"@types\/react": "^17.0.0"/g' package.json
96 sed -i 's/"@types\/react-dom": "\^16\.[^"]*"/"@types\/react-dom": "^17.0.0"/g' package.json
97 # Add skipLibCheck to tsconfig.json to fix TS2786 type errors
98 sed -i 's/"strict": false/"strict": false, "skipLibCheck": true/' tsconfig.json
99 # Rewrite webpack.config.js with all necessary fixes
100 cat > webpack.config.js << 'WEBPACK_EOF'
101const HtmlWebpackPlugin = require("html-webpack-plugin")
102const NodePolyfillPlugin = require("node-polyfill-webpack-plugin")
103const { GriffelPlugin } = require("@griffel/webpack-plugin")
104const MiniCssExtractPlugin = require("mini-css-extract-plugin")
105
106module.exports = [
107 {
108 mode: "production",
109 entry: "./src/electron.ts",
110 target: "electron-main",
111 module: {
112 rules: [
113 {
114 test: /\.ts$/,
115 include: /src/,
116 resolve: {
117 extensions: [".ts", ".js"],
118 },
119 use: [{ loader: "ts-loader", options: { transpileOnly: true } }],
120 },
121 ],
122 },
123 output: {
124 devtoolModuleFilenameTemplate: "[absolute-resource-path]",
125 path: __dirname + "/dist",
126 filename: "electron.js",
127 },
128 node: {
129 __dirname: false,
130 },
131 },
132 {
133 mode: "production",
134 entry: "./src/preload.ts",
135 target: "electron-preload",
136 module: {
137 rules: [
138 {
139 test: /\.ts$/,
140 include: /src/,
141 resolve: {
142 extensions: [".ts", ".js"],
143 },
144 use: [{ loader: "ts-loader", options: { transpileOnly: true } }],
145 },
146 ],
147 },
148 output: {
149 path: __dirname + "/dist",
150 filename: "preload.js",
151 },
152 },
153 {
154 mode: "production",
155 entry: "./src/index.tsx",
156 target: "web",
157 resolve: {
158 fullySpecified: false,
159 alias: {
160 "react/jsx-runtime": "react/jsx-runtime.js",
161 "react/jsx-dev-runtime": "react/jsx-dev-runtime.js",
162 },
163 },
164 devtool: "source-map",
165 performance: {
166 hints: false,
167 },
168 module: {
169 rules: [
170 {
171 test: /\.(js|ts|tsx)$/,
172 include: [/src/, /node_modules\/@fluentui/],
173 use: {
174 loader: "@griffel/webpack-plugin/loader",
175 },
176 },
177 {
178 test: /\.ts(x?)$/,
179 include: /src/,
180 resolve: {
181 extensions: [".ts", ".tsx", ".js"],
182 },
183 use: {
184 loader: "ts-loader",
185 options: { transpileOnly: true }
186 },
187 },
188 {
189 test: /\.css$/,
190 use: [MiniCssExtractPlugin.loader, "css-loader"],
191 },
192 ],
193 },
194 output: {
195 path: __dirname + "/dist",
196 filename: "index.js",
197 },
198 plugins: [
199 new NodePolyfillPlugin({
200 additionalAliases: ["process"],
201 }),
202 new HtmlWebpackPlugin({
203 template: "./src/index.html",
204 }),
205 new MiniCssExtractPlugin(),
206 new GriffelPlugin(),
207 ],
208 },
209]
210WEBPACK_EOF
211 echo "Webpack config rewritten successfully"
212 bun install
213}
214build() {
215 cd "${srcdir}/${pkgname%-git}.git"
216 _ensure_local_nvm
217 _set_build_env
218 export NODE_ENV=production
219 bun run build
220 bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
221}
222package() {
223 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
224 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
225 local _app_dir=$(_get_app_dir)
226 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
227 rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
228 _icon_sizes=(16x16 32x32 48x48 64x64 128x128 256x256 512x512)
229 for _icons in "${_icon_sizes[@]}";do
230 install -Dm644 "${srcdir}/${pkgname%-git}.git/build/icons/${_icons}.png" \
231 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
232 done
233 install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
234 install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
235}
236

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-09-24 01:41
@@ -1,11 +1,11 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=fluent-reader-git
_pkgname='Fluent Reader'
-pkgver=1.1.4.r3.g759d60b
-_electronversion=34
-_nodeversion=22
+pkgver=1.2.2.r3.g5813998
+_electronversion=41
+_nodeversion=24
pkgrel=1
-pkgdesc="A modern desktop RSS reader.(Use system-wide electron)"
+pkgdesc="A modern desktop RSS reader."
arch=('any')
url="https://hyliu.me/fluent-reader/"
_ghurl="https://github.com/yang991178/fluent-reader"
@@ -16,18 +16,18 @@
"electron${_electronversion}"
)
makedepends=(
- 'npm'
+ 'bun'
'git'
'nvm'
'gendesk'
- 'curl'
+ 'jq'
)
source=(
"${pkgname%-git}.git::git+${_ghurl}.git"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
pkgver() {
cd "${srcdir}/${pkgname%-git}.git"
set -o pipefail
@@ -40,51 +40,197 @@
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
+_get_app_dir() {
+ find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
+}
+_get_electron_version() {
+ _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
+ -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+}
+_set_build_env() {
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
+ export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
+ export BUN_INSTALL_BIN="${HOME}/.bun/bin"
+ export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
+ export BUN_CONFIG_SKIP_LOAD_LOCKFILE=1
+ export BUN_DISABLE_DOTENV=1
+ export DO_NOT_TRACK=1
+ export BUN_JOBS="$(nproc)"
+ mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
+}
prepare() {
+ cd "${srcdir}/${pkgname%-git}.git"
+ _get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
s/@runname@/app.asar/g
s/@cfgdirname@/${pkgname%-git}/g
- s/@options@//g
" -i "${srcdir}/${pkgname%-git}.sh"
+ gendesk -q -f -n \
+ --pkgname="${pkgname%-git}" \
+ --pkgdesc="${pkgdesc}" \
+ --categories="Utility" \
+ --name="${_pkgname}" \
+ --exec="${pkgname%-git} %U"
_ensure_local_nvm
- gendesk -q -f -n --pkgname="${pkgname%-git}" --pkgdesc="${pkgdesc}" --categories="Utility" --name="${_pkgname}" --exec="${pkgname%-git} %U"
- cd "${srcdir}/${pkgname%-git}.git"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- HOME="${srcdir}/.electron-gyp"
- {
- echo -e '\n'
- #echo 'build_from_source=true'
- echo "cache=${srcdir}/.npm_cache"
- } >> .npmrc
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- echo 'registry=https://registry.npmmirror.com'
- echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
- echo 'electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/'
- } >> .npmrc
- find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
- fi
+ _set_build_env
sed "s/.\/bin\/\${platform}\/\${arch}\//release/g" -i electron-builder.yml
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development npm install
+ export NODE_ENV=development
+ # Upgrade React to v17 for jsx-runtime compatibility
+ sed -i 's/"react": "\^16\.[^"]*"/"react": "^17.0.2"/g' package.json
+ sed -i 's/"react-dom": "\^16\.[^"]*"/"react-dom": "^17.0.2"/g' package.json
+ sed -i 's/"@types\/react": "\^16\.[^"]*"/"@types\/react": "^17.0.0"/g' package.json
+ sed -i 's/"@types\/react-dom": "\^16\.[^"]*"/"@types\/react-dom": "^17.0.0"/g' package.json
+ # Add skipLibCheck to tsconfig.json to fix TS2786 type errors
+ sed -i 's/"strict": false/"strict": false, "skipLibCheck": true/' tsconfig.json
+ # Rewrite webpack.config.js with all necessary fixes
+ cat > webpack.config.js << 'WEBPACK_EOF'
+const HtmlWebpackPlugin = require("html-webpack-plugin")
+const NodePolyfillPlugin = require("node-polyfill-webpack-plugin")
+const { GriffelPlugin } = require("@griffel/webpack-plugin")
+const MiniCssExtractPlugin = require("mini-css-extract-plugin")
+
+module.exports = [
+ {
+ mode: "production",
+ entry: "./src/electron.ts",
+ target: "electron-main",
+ module: {
+ rules: [
+ {
+ test: /\.ts$/,
+ include: /src/,
+ resolve: {
+ extensions: [".ts", ".js"],
+ },
+ use: [{ loader: "ts-loader", options: { transpileOnly: true } }],
+ },
+ ],
+ },
+ output: {
+ devtoolModuleFilenameTemplate: "[absolute-resource-path]",
+ path: __dirname + "/dist",
+ filename: "electron.js",
+ },
+ node: {
+ __dirname: false,
+ },
+ },
+ {
+ mode: "production",
+ entry: "./src/preload.ts",
+ target: "electron-preload",
+ module: {
+ rules: [
+ {
+ test: /\.ts$/,
+ include: /src/,
+ resolve: {
+ extensions: [".ts", ".js"],
+ },
+ use: [{ loader: "ts-loader", options: { transpileOnly: true } }],
+ },
+ ],
+ },
+ output: {
+ path: __dirname + "/dist",
+ filename: "preload.js",
+ },
+ },
+ {
+ mode: "production",
+ entry: "./src/index.tsx",
+ target: "web",
+ resolve: {
+ fullySpecified: false,
+ alias: {
+ "react/jsx-runtime": "react/jsx-runtime.js",
+ "react/jsx-dev-runtime": "react/jsx-dev-runtime.js",
+ },
+ },
+ devtool: "source-map",
+ performance: {
+ hints: false,
+ },
+ module: {
+ rules: [
+ {
+ test: /\.(js|ts|tsx)$/,
+ include: [/src/, /node_modules\/@fluentui/],
+ use: {
+ loader: "@griffel/webpack-plugin/loader",
+ },
+ },
+ {
+ test: /\.ts(x?)$/,
+ include: /src/,
+ resolve: {
+ extensions: [".ts", ".tsx", ".js"],
+ },
+ use: {
+ loader: "ts-loader",
+ options: { transpileOnly: true }
+ },
+ },
+ {
+ test: /\.css$/,
+ use: [MiniCssExtractPlugin.loader, "css-loader"],
+ },
+ ],
+ },
+ output: {
+ path: __dirname + "/dist",
+ filename: "index.js",
+ },
+ plugins: [
+ new NodePolyfillPlugin({
+ additionalAliases: ["process"],
+ }),
+ new HtmlWebpackPlugin({
+ template: "./src/index.html",
+ }),
+ new MiniCssExtractPlugin(),
+ new GriffelPlugin(),
+ ],
+ },
+]
+WEBPACK_EOF
+ echo "Webpack config rewritten successfully"
+ bun install
}
build() {
cd "${srcdir}/${pkgname%-git}.git"
- local electronDist="/usr/lib/electron${_electronversion}"
- NODE_ENV=production npm run build
- NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${electronDist} --config electron-builder.yml"
+ _ensure_local_nvm
+ _set_build_env
+ export NODE_ENV=production
+ bun run build
+ bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/release/linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"
+ install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
+ local _app_dir=$(_get_app_dir)
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
_icon_sizes=(16x16 32x32 48x48 64x64 128x128 256x256 512x512)
for _icons in "${_icon_sizes[@]}";do
install -Dm644 "${srcdir}/${pkgname%-git}.git/build/icons/${_icons}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
done
- install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-09-24 01:41:16 Medium 1
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion