folo
The flagged pattern involves using npm to install 'node-addon-api' and 'node-gyp' globally during prepare(), but these are standard build tools required for native Node.js addons and are not executed as part of the runtime; the source is from the official npm registry or a known mirror, and the package otherwise builds from verified upstream source.
Triggered rules
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves using npm to install 'node-addon-api' and 'node-gyp' globally during prepare(), but these are standard build tools required for native Node.js addons and are not executed as part of the runtime; the source is from the official npm registry or a known mirror, and the package otherwise builds from verified upstream source.
1 higher static finding superseded - not the current verdict (shown for transparency)
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:91
npm install -g node-addon-api node-gyp
PKGBUILD
1 offending line(s) highlighted# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=folo
_pkgname=Folo
pkgver=1.13.0
_electronversion=43
_nodeversion=22
pkgrel=1
pkgdesc="Organizes content into one timeline, keeping you updated on what matters, noise-free. Share lists, explore collections, and enjoy distraction-free browsing.(Prebuilt version.Use system-wide electron)"
arch=('any')
url="https://folo.is/"
_ghurl="https://github.com/RSSNext/Folo"
license=('GPL-3.0-only')
depends=(
"electron${_electronversion}"
)
makedepends=(
'npm'
'nvm'
'gendesk'
'curl'
'pnpm'
'python-setuptools'
'git'
'jq'
)
source=(
"${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/desktop/v${pkgver}.tar.gz"
"${pkgname}.sh"
)
sha256sums=('2fab76f305dacb06fd806197edb19c416176ee58d85c3c39d96066ff965767cc'
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
_get_app_dir() {
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
export HOME="${srcdir}/.electron-gyp"
{
export PNPM_LINK_WORKSPACE_PACKAGES=true
export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
export PNPM_SHAMEFULLY_HOIST=true
export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
export PNPM_NODE_LINKER=hoisted
export PNPM_NETWORK_CONCURRENCY=32
}
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
{
export pnpm_config_registry="https://registry.npmmirror.com"
export npm_config_registry="https://registry.npmmirror.com"
export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
}
fi
}
_get_electron_version() {
_elec_ver=$(find "${srcdir}" -maxdepth 4 -name "package.json" ! -name "node_modules" \
-exec jq -r '.devDependencies.electron // empty' {} + 2>/dev/null | grep -v "^$" | head -n 1)
_elec_ver=$(echo "${_elec_ver}" | sed 's/[^0-9.]//g')
_main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
}
prepare() {
cd "${srcdir}/${_pkgname}-desktop-v${pkgver}"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname}/g
s/@runname@/app.asar/g
s/@cfgdirname@/${pkgname}/g
" "${srcdir}/${pkgname}.sh"
gendesk -q -f -n \
--pkgname="${pkgname}" \
--pkgdesc="${pkgdesc}" \
--categories="Utility" \
--name="${_pkgname}" \
--exec="${pkgname} %U"
_set_build_env
_ensure_local_nvm
npm install -g node-addon-api node-gyp
export NODE_PATH="$(npm root -g)"
sed -i -e "
s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g
s/electron-forge make/electron-forge package/g
" apps/desktop/package.json
NODE_ENV=development pnpm install
}
build() {
cd "${srcdir}/${_pkgname}-desktop-v${pkgver}/apps/desktop"
_set_build_env
_ensure_local_nvm
cp .env.example .env
NODE_ENV=production pnpm update:main-hash
NODE_ENV=production pnpm build:electron-vite
NODE_ENV=production pnpm build:electron-forge
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/apps/desktop/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
Changes since previous scan
--- PKGBUILD @ 2026-09-02 00:02+++ PKGBUILD @ 2026-09-17 00:27@@ -1,7 +1,7 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> pkgname=folo _pkgname=Folo-pkgver=1.12.0+pkgver=1.13.0 _electronversion=43 _nodeversion=22 pkgrel=1@@ -27,7 +27,7 @@ "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/desktop/v${pkgver}.tar.gz" "${pkgname}.sh" )-sha256sums=('d4bc9f9cbc86343ce5e576e046428afe96930073ed8d0731faa5cf55deef106f'+sha256sums=('2fab76f305dacb06fd806197edb19c416176ee58d85c3c39d96066ff965767cc' 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d') _ensure_local_nvm() { local NVM_DIR="${srcdir}/.nvm"@@ -110,6 +110,7 @@ install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}" local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1) cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"+ rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar" install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/apps/desktop/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png" install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications" install -Dm644 "${srcdir}/${_pkgname}-desktop-v${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 05:49:42 | Medium | 1 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |