◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

folo

maintainer zxp19821005 · 1 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The flagged 'undeclared external package' install via pnpm occurs within the project's own source tree after switching to its directory; this is part of building the application from its official source and uses the project's declared dependencies, not an arbitrary external package.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged 'undeclared external package' install via pnpm occurs within the project's own source tree after switching to its directory; this is part of building the application from its official source and uses the project's declared dependencies, not an arbitrary external package.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:91 npm install -g node-addon-api node-gyp

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=folo
3_pkgname=Folo
4pkgver=1.12.0
5_electronversion=43
6_nodeversion=22
7pkgrel=1
8pkgdesc="Organizes content into one timeline, keeping you updated on what matters, noise-free. Share lists, explore collections, and enjoy distraction-free browsing.(Prebuilt version.Use system-wide electron)"
9arch=('any')
10url="https://folo.is/"
11_ghurl="https://github.com/RSSNext/Folo"
12license=('GPL-3.0-only')
13depends=(
14 "electron${_electronversion}"
15)
16makedepends=(
17 'npm'
18 'nvm'
19 'gendesk'
20 'curl'
21 'pnpm'
22 'python-setuptools'
23 'git'
24 'jq'
25)
26source=(
27 "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/desktop/v${pkgver}.tar.gz"
28 "${pkgname}.sh"
29)
30sha256sums=('d4bc9f9cbc86343ce5e576e046428afe96930073ed8d0731faa5cf55deef106f'
31 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
32_ensure_local_nvm() {
33 local NVM_DIR="${srcdir}/.nvm"
34 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
35 nvm install "${_nodeversion}"
36 nvm use "${_nodeversion}"
37}
38_get_app_dir() {
39 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
40}
41_set_build_env() {
42 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
43 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
44 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
45 export HOME="${srcdir}/.electron-gyp"
46 {
47 export PNPM_LINK_WORKSPACE_PACKAGES=true
48 export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
49 export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
50 export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
51 export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
52 export PNPM_SHAMEFULLY_HOIST=true
53 export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
54 export PNPM_NODE_LINKER=hoisted
55 export PNPM_NETWORK_CONCURRENCY=32
56 }
57 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
58 {
59 export pnpm_config_registry="https://registry.npmmirror.com"
60 export npm_config_registry="https://registry.npmmirror.com"
61 export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
62 export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
63 export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
64 }
65 fi
66}
67_get_electron_version() {
68 _elec_ver=$(find "${srcdir}" -maxdepth 4 -name "package.json" ! -name "node_modules" \
69 -exec jq -r '.devDependencies.electron // empty' {} + 2>/dev/null | grep -v "^$" | head -n 1)
70 _elec_ver=$(echo "${_elec_ver}" | sed 's/[^0-9.]//g')
71 _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
72 echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
73}
74prepare() {
75 cd "${srcdir}/${_pkgname}-desktop-v${pkgver}"
76 _get_electron_version
77 sed -i -e "
78 s/@electronversion@/${_electronversion}/g
79 s/@appname@/${pkgname}/g
80 s/@runname@/app.asar/g
81 s/@cfgdirname@/${pkgname}/g
82 " "${srcdir}/${pkgname}.sh"
83 gendesk -q -f -n \
84 --pkgname="${pkgname}" \
85 --pkgdesc="${pkgdesc}" \
86 --categories="Utility" \
87 --name="${_pkgname}" \
88 --exec="${pkgname} %U"
89 _set_build_env
90 _ensure_local_nvm
91 npm install -g node-addon-api node-gyp
92 export NODE_PATH="$(npm root -g)"
93 sed -i -e "
94 s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g
95 s/electron-forge make/electron-forge package/g
96 " apps/desktop/package.json
97 NODE_ENV=development pnpm install
98}
99build() {
100 cd "${srcdir}/${_pkgname}-desktop-v${pkgver}/apps/desktop"
101 _set_build_env
102 _ensure_local_nvm
103 cp .env.example .env
104 NODE_ENV=production pnpm update:main-hash
105 NODE_ENV=production pnpm build:electron-vite
106 NODE_ENV=production pnpm build:electron-forge
107}
108package() {
109 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
110 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
111 local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
112 cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
113 install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/apps/desktop/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
114 install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
115 install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
116}
117

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=folo
_pkgname=Folo
-pkgver=1.11.0
+pkgver=1.12.0
_electronversion=43
_nodeversion=22
pkgrel=1
@@ -27,7 +27,7 @@
"${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/desktop/v${pkgver}.tar.gz"
"${pkgname}.sh"
)
-sha256sums=('d5a80bb2914010ce82108c9709b7e3f96b482601c107142f633c93195d99c2bb'
+sha256sums=('d4bc9f9cbc86343ce5e576e046428afe96930073ed8d0731faa5cf55deef106f'
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
@@ -109,7 +109,7 @@
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
- cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname}/"
+ cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/apps/desktop/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 11:17:50 MEDIUM 1
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion