folo

LOW
maintainer zxp19821005 1 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The flagged pattern involves using npm to install 'node-addon-api' and 'node-gyp' globally during prepare(), but these are standard build tools required for native Node.js addons and are not executed as part of the runtime; the source is from the official npm registry or a known mirror, and the package otherwise builds from verified upstream source.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves using npm to install 'node-addon-api' and 'node-gyp' globally during prepare(), but these are standard build tools required for native Node.js addons and are not executed as part of the runtime; the source is from the official npm registry or a known mirror, and the package otherwise builds from verified upstream source.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:91 npm install -g node-addon-api node-gyp

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=folo
3_pkgname=Folo
4pkgver=1.13.0
5_electronversion=43
6_nodeversion=22
7pkgrel=1
8pkgdesc="Organizes content into one timeline, keeping you updated on what matters, noise-free. Share lists, explore collections, and enjoy distraction-free browsing.(Prebuilt version.Use system-wide electron)"
9arch=('any')
10url="https://folo.is/"
11_ghurl="https://github.com/RSSNext/Folo"
12license=('GPL-3.0-only')
13depends=(
14 "electron${_electronversion}"
15)
16makedepends=(
17 'npm'
18 'nvm'
19 'gendesk'
20 'curl'
21 'pnpm'
22 'python-setuptools'
23 'git'
24 'jq'
25)
26source=(
27 "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/desktop/v${pkgver}.tar.gz"
28 "${pkgname}.sh"
29)
30sha256sums=('2fab76f305dacb06fd806197edb19c416176ee58d85c3c39d96066ff965767cc'
31 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
32_ensure_local_nvm() {
33 local NVM_DIR="${srcdir}/.nvm"
34 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
35 nvm install "${_nodeversion}"
36 nvm use "${_nodeversion}"
37}
38_get_app_dir() {
39 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
40}
41_set_build_env() {
42 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
43 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
44 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
45 export HOME="${srcdir}/.electron-gyp"
46 {
47 export PNPM_LINK_WORKSPACE_PACKAGES=true
48 export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
49 export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
50 export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
51 export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
52 export PNPM_SHAMEFULLY_HOIST=true
53 export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
54 export PNPM_NODE_LINKER=hoisted
55 export PNPM_NETWORK_CONCURRENCY=32
56 }
57 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
58 {
59 export pnpm_config_registry="https://registry.npmmirror.com"
60 export npm_config_registry="https://registry.npmmirror.com"
61 export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
62 export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
63 export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
64 }
65 fi
66}
67_get_electron_version() {
68 _elec_ver=$(find "${srcdir}" -maxdepth 4 -name "package.json" ! -name "node_modules" \
69 -exec jq -r '.devDependencies.electron // empty' {} + 2>/dev/null | grep -v "^$" | head -n 1)
70 _elec_ver=$(echo "${_elec_ver}" | sed 's/[^0-9.]//g')
71 _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
72 echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
73}
74prepare() {
75 cd "${srcdir}/${_pkgname}-desktop-v${pkgver}"
76 _get_electron_version
77 sed -i -e "
78 s/@electronversion@/${_electronversion}/g
79 s/@appname@/${pkgname}/g
80 s/@runname@/app.asar/g
81 s/@cfgdirname@/${pkgname}/g
82 " "${srcdir}/${pkgname}.sh"
83 gendesk -q -f -n \
84 --pkgname="${pkgname}" \
85 --pkgdesc="${pkgdesc}" \
86 --categories="Utility" \
87 --name="${_pkgname}" \
88 --exec="${pkgname} %U"
89 _set_build_env
90 _ensure_local_nvm
91 npm install -g node-addon-api node-gyp
92 export NODE_PATH="$(npm root -g)"
93 sed -i -e "
94 s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g
95 s/electron-forge make/electron-forge package/g
96 " apps/desktop/package.json
97 NODE_ENV=development pnpm install
98}
99build() {
100 cd "${srcdir}/${_pkgname}-desktop-v${pkgver}/apps/desktop"
101 _set_build_env
102 _ensure_local_nvm
103 cp .env.example .env
104 NODE_ENV=production pnpm update:main-hash
105 NODE_ENV=production pnpm build:electron-vite
106 NODE_ENV=production pnpm build:electron-forge
107}
108package() {
109 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
110 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
111 local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
112 cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
113 rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
114 install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/apps/desktop/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
115 install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
116 install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
117}
118

Changes since previous scan

--- PKGBUILD @ 2026-09-02 00:02
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=folo
_pkgname=Folo
-pkgver=1.12.0
+pkgver=1.13.0
_electronversion=43
_nodeversion=22
pkgrel=1
@@ -27,7 +27,7 @@
"${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/desktop/v${pkgver}.tar.gz"
"${pkgname}.sh"
)
-sha256sums=('d4bc9f9cbc86343ce5e576e046428afe96930073ed8d0731faa5cf55deef106f'
+sha256sums=('2fab76f305dacb06fd806197edb19c416176ee58d85c3c39d96066ff965767cc'
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
@@ -110,6 +110,7 @@
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
+ rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/apps/desktop/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 05:49:42 Medium 1
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion