folia-major

LOW
maintainer zxp19821005 0 votes scanned 2026-10-03 00:23:04.761738
View on AUR
Why flagged

The npx execution in build() runs 'electron-builder' and 'vite build' on the project's own source code from a trusted GitHub release tarball, which is a standard build process for Electron apps; no remote code execution or untrusted payloads are involved.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx execution in build() runs 'electron-builder' and 'vite build' on the project's own source code from a trusted GitHub release tarball, which is a standard build process for Electron apps; no remote code execution or untrusted payloads are involved.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:108 npx vite build

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=folia-major
3_pkgname=Folia
4pkgver=0.7.9
5_electronversion=43
6_nodeversion=24
7pkgrel=1
8pkgdesc="Local music/navigation/third-party multi-platform online music player focusing on gorgeous lyrics animation effects.专注于绚丽的歌词动画效果的本地音乐/navidrome/第三方多平台在线音乐播放器."
9arch=('any')
10url="https://folia-site.cielaniska.top/"
11_ghurl="https://github.com/chthollyphile/folia-major"
12license=('AGPL-3.0-only')
13depends=(
14 "electron${_electronversion}"
15 'python'
16 'python-numpy'
17 'python-psutil'
18 'ffmpeg'
19)
20makedepends=(
21 'npm'
22 'nvm'
23 'git'
24 'rustup'
25 'jq'
26)
27source=(
28 "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
29 "${pkgname}.sh"
30)
31sha256sums=('7d5cbfd4155eefea5f2cd74ba78c25e6267261f2350e67d1477a2cac7ffa8615'
32 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
33_get_project_dir() {
34 local d
35 while IFS= read -r d; do
36 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
37 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
38}
39_ensure_local_nvm() {
40 local NVM_DIR="${srcdir}/.nvm"
41 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
42 nvm install "${_nodeversion}"
43 nvm use "${_nodeversion}"
44}
45_set_build_env() {
46 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
47 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
48 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
49 export ELECTRON_BUILDER_OFFLINE=true
50 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
51 export HOME="${srcdir}/.home"
52 export XDG_CACHE_HOME="${HOME}/.cache"
53 export XDG_CONFIG_HOME="${HOME}/.config"
54 export XDG_DATA_HOME="${HOME}/.local/share"
55 export npm_config_cache="${HOME}/.npm_cache"
56 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
57 export COREPACK_HOME="${HOME}/.corepack"
58 export npm_config_audit=false
59 export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
60 export CARGO_HOME="${HOME}/.cargo"
61 export CARGO_NET_GIT_FETCH_WITH_CLI=true
62 export CARGO_NET_RETRY=5
63 export CARGO_HTTP_MULTIPLEXING=false
64 export CARGO_INCREMENTAL=0
65 export CARGO_TERM_COLOR=never
66 export CARGO_PROFILE_RELEASE_STRIP=symbols
67 mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}" "${CARGO_HOME}"
68}
69_get_app_dir() {
70 find "$(_get_project_dir)" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
71}
72_get_electron_version() {
73 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
74 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
75 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
76 [[ -z "${_elec_ver}" ]] && return 1
77 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
78}
79prepare() {
80 cd "$(_get_project_dir)"
81 _get_electron_version
82 sed -i -e "
83 s/@electronversion@/${_electronversion}/g
84 s/@appname@/${pkgname}/g
85 s/@runname@/app.asar/g
86 s/@cfgdirname@/${_pkgname}/g
87 " "${srcdir}/${pkgname}.sh"
88 _ensure_local_nvm
89 _set_build_env
90 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
91 find electron -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
92 cp .env.example .env
93 rustup update stable
94 rustup default stable
95 export NODE_ENV=development
96 export npm_config_allow_remote=all
97 rm -rf package-lock.json
98 npm install --legacy-peer-deps
99}
100build() {
101 cd "$(_get_project_dir)"
102 _ensure_local_nvm
103 _set_build_env
104 export ELECTRON=true
105 export NODE_ENV=production
106 export NODE_OPTIONS="--max-old-space-size=4096"
107 npm run build:vercel-api
108 npx vite build
109 npm run build:windowtolayer
110 npm run build:wallpaper-helper
111 npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
112 local _app_dir="$(_get_app_dir)"
113 ln -sf "/usr/bin/ffmpeg" "${_app_dir}/resources/ffmpeg-audio/ffmpeg"
114 rm -rf "${_app_dir}/resources/default_app.asar"
115}
116package() {
117 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
118 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
119 local _app_dir="$(_get_app_dir)"
120 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
121 local _src="$(_get_project_dir)"
122 install -Dm644 "${_src}/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
123 install -Dm644 "${_src}/packaging/aur/${pkgname}-bin/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
124}

Changes since previous scan

--- PKGBUILD @ 2026-09-23 07:39
+++ PKGBUILD @ 2026-10-03 00:23
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=folia-major
_pkgname=Folia
-pkgver=0.7.8
+pkgver=0.7.9
_electronversion=43
_nodeversion=24
pkgrel=1
@@ -21,15 +21,21 @@
'npm'
'nvm'
'git'
- 'curl'
+ 'rustup'
'jq'
)
source=(
"${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
"${pkgname}.sh"
)
-sha256sums=('0f90530b31af85ef00de84d08b6b5f5762820d161ca9f75faf1318119a1901cb'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+sha256sums=('7d5cbfd4155eefea5f2cd74ba78c25e6267261f2350e67d1477a2cac7ffa8615'
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
@@ -50,19 +56,28 @@
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
export COREPACK_HOME="${HOME}/.corepack"
export npm_config_audit=false
- mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
+ export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
+ export CARGO_HOME="${HOME}/.cargo"
+ export CARGO_NET_GIT_FETCH_WITH_CLI=true
+ export CARGO_NET_RETRY=5
+ export CARGO_HTTP_MULTIPLEXING=false
+ export CARGO_INCREMENTAL=0
+ export CARGO_TERM_COLOR=never
+ export CARGO_PROFILE_RELEASE_STRIP=symbols
+ mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}" "${CARGO_HOME}"
}
_get_app_dir() {
- find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
+ find "$(_get_project_dir)" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
@@ -75,28 +90,35 @@
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
find electron -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
cp .env.example .env
+ rustup update stable
+ rustup default stable
export NODE_ENV=development
export npm_config_allow_remote=all
- npm install
+ rm -rf package-lock.json
+ npm install --legacy-peer-deps
}
build() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
_ensure_local_nvm
_set_build_env
export ELECTRON=true
export NODE_ENV=production
- npm run build
+ export NODE_OPTIONS="--max-old-space-size=4096"
+ npm run build:vercel-api
+ npx vite build
+ npm run build:windowtolayer
+ npm run build:wallpaper-helper
npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
- local _app_dir=$(_get_app_dir)
+ local _app_dir="$(_get_app_dir)"
ln -sf "/usr/bin/ffmpeg" "${_app_dir}/resources/ffmpeg-audio/ffmpeg"
rm -rf "${_app_dir}/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _app_dir=$(_get_app_dir)
+ local _app_dir="$(_get_app_dir)"
cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/packaging/aur/${pkgname}-bin/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ local _src="$(_get_project_dir)"
+ install -Dm644 "${_src}/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
+ install -Dm644 "${_src}/packaging/aur/${pkgname}-bin/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
}
-

Scan history

Scanned at (UTC)SeverityRules
2026-10-03 00:23:04 Low 2
2026-10-02 00:00:32 Low 2
2026-10-01 00:02:06 Low 2
2026-09-30 00:20:07 Low 2
2026-09-29 00:07:46 Low 2
2026-09-28 09:20:32 Medium 1
2026-09-23 07:39:45 Clean 0
2026-09-10 05:20:15 Clean 0
2026-09-09 05:18:57 Clean 0
2026-09-07 09:14:05 Clean 0
2026-09-01 01:46:26 Clean 0
2026-08-31 03:44:41 Clean 0
2026-08-28 00:07:31 Clean 0
2026-08-27 03:31:49 Low 2
2026-08-27 00:08:17 Low 2
2026-08-26 00:12:07 Low 2
2026-08-25 00:14:31 Low 2
2026-08-24 05:22:02 Low 2
2026-08-24 00:17:16 Low 2
2026-08-23 00:10:13 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion