focustune-git

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The `npm add -D '@sveltejs/adapter-auto'` call installs an additional npm package not declared in package.json, but '@sveltejs/adapter-auto' is a well-known, official SvelteKit package published by the Svelte core team on the standard npm registry. This is a common pattern in SvelteKit projects where the adapter may be missing from the repo's package.json. The package is fetched from the official npm registry (or the npmmirror.com mirror for CN users, which mirrors the official registry). There is no unofficial or personal host involved. The main concern is reproducibility and the lack of a lockfile pin for this extra package, which is sloppy but not a meaningful supply-chain risk given the package's provenance. The CN mirror detection via `curl -s ipinfo.io/country` is a minor privacy/reliability concern but not a security threat. Overall this is low severity: non-standard packaging practice but no real supply-chain attack vector.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The `npm add -D '@sveltejs/adapter-auto'` call installs an additional npm package not declared in package.json, but '@sveltejs/adapter-auto' is a well-known, official SvelteKit package published by the Svelte core team on the standard npm registry. This is a common pattern in SvelteKit projects where the adapter may be missing from the repo's package.json. The package is fetched from the official npm registry (or the npmmirror.com mirror for CN users, which mirrors the official registry). There is no unofficial or personal host involved. The main concern is reproducibility and the lack of a lockfile pin for this extra package, which is sloppy but not a meaningful supply-chain risk given the package's provenance. The CN mirror detection via `curl -s ipinfo.io/country` is a minor privacy/reliability concern but not a security threat. Overall this is low severity: non-standard packaging practice but no real supply-chain attack vector.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:65 npm add -D "@sveltejs/adapter-auto"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=focustune-git
    
      3pkgver=0.1.1.r5.g56e6aa2
    
      4_electronversion=28
    
      5_nodeversion=18
    
      6pkgrel=1
    
      7pkgdesc="A simple no clutter desktop app that serves as a container for 24/7 music live streams."
    
      8arch=('any')
    
      9url="https://focustune.isaxk.com/"
    
      10_ghurl="https://github.com/isaxk/focustune"
    
      11license=('LicenseRef-unknown')
    
      12conflicts=("${pkgname%-git}")
    
      13provides=("${pkgname%-git}=${pkgver%.r*}")
    
      14depends=(
    
      15    "electron${_electronversion}"
    
      16)
    
      17makedepends=(
    
      18    'npm'
    
      19    'git'
    
      20    'nvm'
    
      21    'gendesk'
    
      22    'curl'
    
      23)
    
      24source=(
    
      25    "${pkgname//-/.}::git+${_ghurl}.git"
    
      26    "${pkgname%-git}.sh")
    
      27sha256sums=('SKIP'
    
      28            '2b2e8aeed33fd71c521e49fd54fb2fa81218d16aef8bccb88d77909055ab8051')
    
      29pkgver() {
    
      30    cd "${srcdir}/${pkgname//-/.}"
    
      31    git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g'
    
      32}
    
      33_ensure_local_nvm() {
    
      34    export NVM_DIR="${srcdir}/.nvm"
    
      35    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      36    nvm install "${_nodeversion}"
    
      37    nvm use "${_nodeversion}"
    
      38}
    
      39build() {
    
      40    sed -e "s|@electronversion@|${_electronversion}|" \
    
      41        -e "s|@appname@|${pkgname%-git}|g" \
    
      42        -e "s|@runname@|app.asar|g" \
    
      43        -e "s|@cfgdirname@|${pkgname%-git}|g" \
    
      44        -e "s|@options@|env ELECTRON_OZONE_PLATFORM_HINT=auto|g" \
    
      45        -i "${srcdir}/${pkgname%-git}.sh"
    
      46    _ensure_local_nvm
    
      47    gendesk -q -f -n --pkgname="${pkgname%-git}" --pkgdesc="${pkgdesc}" --categories="AudioVideo" --name="${pkgname%-git}" --exec="${pkgname%-git} %U"
    
      48    cd "${srcdir}/${pkgname//-/.}"
    
      49    export npm_config_build_from_source=true
    
      50    export npm_config_cache="${srcdir}/.npm_cache"
    
      51    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      52    #export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
      53    #export npm_config_target="${SYSTEM_ELECTRON_VERSION}"
    
      54    #export ELECTRONVERSION="${_electronversion}"
    
      55    HOME="${srcdir}/.electron-gyp"
    
      56    if [ `curl -s ipinfo.io/country | grep CN | wc -l ` -ge 1 ];then
    
      57        export npm_config_registry=https://registry.npmmirror.com
    
      58        export npm_config_disturl=https://registry.npmmirror.com/-/binary/node/
    
      59        export npm_config_electron_mirror=https://registry.npmmirror.com/-/binary/electron/
    
      60        export npm_config_electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/
    
      61    else
    
      62        echo "Your network is OK."
    
      63    fi
    
      64    NODE_ENV=development npm install
    
      65    npm add -D "@sveltejs/adapter-auto"
    
      66    NODE_ENV=production npm run build:unpack
    
      67}
    
      68package() {
    
      69    install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
      70    install -Dm644 "${srcdir}/${pkgname//-/.}/dist/linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"
    
      71    cp -r "${srcdir}/${pkgname//-/.}/dist/linux-"*/resources/app.asar.unpacked "${pkgdir}/usr/lib/${pkgname%-git}"
    
      72    install -Dm644 "${srcdir}/${pkgname//-/.}/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
    
      73    install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
      74    install -Dm644 "${srcdir}/${pkgname//-/.}/dist/linux-"*/LICENSE* -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      75}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2