folo-git

LOW
maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The flagged pattern involves installing Node.js packages via pnpm during build, but this is part of building the project from its own source using declared makedepends; the packages are resolved from npm/pnpm registries with mirror fallbacks for China, which is common and not inherently malicious.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves installing Node.js packages via pnpm during build, but this is part of building the project from its own source using declared makedepends; the packages are resolved from npm/pnpm registries with mirror fallbacks for China, which is common and not inherently malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:111 NODE_ENV=development pnpm add -D -w node-addon-api node-gyp

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=folo-git
3_pkgname=Folo
4pkgver=1.13.0.r11.g8b097ab
5_electronversion=43
6_nodeversion=22
7pkgrel=1
8pkgdesc="Organizes content into one timeline, keeping you updated on what matters, noise-free. Share lists, explore collections, and enjoy distraction-free browsing."
9arch=('any')
10url="https://folo.is/"
11_ghurl="https://github.com/RSSNext/Folo"
12license=('GPL-3.0-only')
13conflicts=("${pkgname%-git}")
14provides=("${pkgname%-git}=${pkgver%.r*}")
15depends=(
16 "electron${_electronversion}"
17)
18makedepends=(
19 'npm'
20 'nvm'
21 'gendesk'
22 'curl'
23 'git'
24 'pnpm'
25 'python-setuptools'
26 'jq'
27 'zip'
28)
29source=(
30 "${pkgname//-/.}::git+${_ghurl}.git"
31 "${pkgname%-git}.sh"
32)
33sha256sums=('SKIP'
34 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
35pkgver() {
36 cd "${srcdir}/${pkgname//-/.}"
37 set -o pipefail
38 git describe --long --abbrev=7 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/mobile\@//g;s/desktop@//g' ||
39 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
40}
41_ensure_local_nvm() {
42 local NVM_DIR="${srcdir}/.nvm"
43 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
44 nvm install "${_nodeversion}"
45 nvm use "${_nodeversion}"
46}
47_get_app_dir() {
48 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
49}
50_set_build_env() {
51 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
52 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
53 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
54 export HOME="${srcdir}/.electron-gyp"
55 export CXXFLAGS="${CXXFLAGS} -std=c++17"
56 export CFLAGS="${CFLAGS} -std=c++17"
57 export npm_config_build_from_source=true
58 {
59 export PNPM_LINK_WORKSPACE_PACKAGES=true
60 export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
61 export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
62 export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
63 export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
64 export PNPM_SHAMEFULLY_HOIST=true
65 export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
66 export PNPM_NODE_LINKER=hoisted
67 export PNPM_NETWORK_CONCURRENCY=32
68 }
69 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
70 {
71 export pnpm_config_registry="https://registry.npmmirror.com"
72 export npm_config_registry="https://registry.npmmirror.com"
73 export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
74 export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
75 export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
76 }
77 fi
78}
79_get_electron_version() {
80 _elec_ver=$(find "${srcdir}" -maxdepth 4 -name "package.json" ! -name "node_modules" \
81 -exec jq -r '.devDependencies.electron // empty' {} + 2>/dev/null | grep -v "^$" | head -n 1)
82 _elec_ver=$(echo "${_elec_ver}" | sed 's/[^0-9.]//g')
83 _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
84 echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
85}
86prepare() {
87 cd "${srcdir}/${pkgname//-/.}"
88 _get_electron_version
89 sed -i -e "
90 s/@electronversion@/${_electronversion}/g
91 s/@appname@/${pkgname%-git}/g
92 s/@runname@/app.asar/g
93 s/@cfgdirname@/${pkgname%-git}/g
94 " "${srcdir}/${pkgname%-git}.sh"
95 gendesk -q -f -n \
96 --pkgname="${pkgname%-git}" \
97 --pkgdesc="${pkgdesc}" \
98 --categories="Utility" \
99 --name="${_pkgname}" \
100 --exec="${pkgname%-git} %U"
101 _set_build_env
102 _ensure_local_nvm
103 # Use project's pnpm version via corepack
104 _pnpmver=`grep "pnpm@" package.json | awk '{print $2}' | sed "s/\"//g;s/pnpm@//g;s/,//g"`
105 corepack enable
106 corepack prepare pnpm@"${_pnpmver}" --activate
107 sed -i -e "
108 s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g
109 s/electron-forge make/electron-forge package/g
110 " apps/desktop/package.json
111 NODE_ENV=development pnpm add -D -w node-addon-api node-gyp
112 NODE_ENV=development pnpm install
113 local _v="${SYSTEM_ELECTRON_VERSION}"
114 local _zd="${srcdir}/electron-zips"
115 local _zf="${_zd}/electron-v${_v}-linux-x64.zip"
116 install -Dm755 -d "${_zd}"
117 ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
118 sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," apps/desktop/forge.config.*
119}
120build() {
121 cd "${srcdir}/${pkgname//-/.}"
122 _set_build_env
123 _ensure_local_nvm
124 cd "${srcdir}/${pkgname//-/.}/apps/desktop"
125 cp .env.example .env
126 NODE_ENV=production pnpm update:main-hash
127 NODE_ENV=production pnpm build:electron-vite
128 cd "${srcdir}/${pkgname//-/.}"
129 NODE_ENV=production pnpm --filter=Folo build:electron-forge
130}
131package() {
132 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
133 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
134 local _app_dir=$(_get_app_dir)
135 cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-git}/"
136 install -Dm644 "${srcdir}/${pkgname//-/.}/apps/desktop/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
137 install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
138 install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
139}
140

Changes since previous scan

--- PKGBUILD @ 2026-09-09 00:04
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,11 +1,11 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=folo-git
_pkgname=Folo
-pkgver=1.11.0.r12.g192a713
+pkgver=1.13.0.r11.g8b097ab
_electronversion=43
_nodeversion=22
pkgrel=1
-pkgdesc="organizes content into one timeline, keeping you updated on what matters, noise-free. Share lists, explore collections, and enjoy distraction-free browsing.(Use system-wide electron)"
+pkgdesc="Organizes content into one timeline, keeping you updated on what matters, noise-free. Share lists, explore collections, and enjoy distraction-free browsing."
arch=('any')
url="https://folo.is/"
_ghurl="https://github.com/RSSNext/Folo"
@@ -24,6 +24,7 @@
'pnpm'
'python-setuptools'
'jq'
+ 'zip'
)
source=(
"${pkgname//-/.}::git+${_ghurl}.git"
@@ -51,6 +52,9 @@
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
export HOME="${srcdir}/.electron-gyp"
+ export CXXFLAGS="${CXXFLAGS} -std=c++17"
+ export CFLAGS="${CFLAGS} -std=c++17"
+ export npm_config_build_from_source=true
{
export PNPM_LINK_WORKSPACE_PACKAGES=true
export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
@@ -96,28 +100,39 @@
--exec="${pkgname%-git} %U"
_set_build_env
_ensure_local_nvm
+ # Use project's pnpm version via corepack
+ _pnpmver=`grep "pnpm@" package.json | awk '{print $2}' | sed "s/\"//g;s/pnpm@//g;s/,//g"`
+ corepack enable
+ corepack prepare pnpm@"${_pnpmver}" --activate
sed -i -e "
s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g
s/electron-forge make/electron-forge package/g
" apps/desktop/package.json
- NODE_ENV=development npm install -g node-addon-api node-gyp
- export NODE_PATH="$(npm root -g)"
+ NODE_ENV=development pnpm add -D -w node-addon-api node-gyp
NODE_ENV=development pnpm install
+ local _v="${SYSTEM_ELECTRON_VERSION}"
+ local _zd="${srcdir}/electron-zips"
+ local _zf="${_zd}/electron-v${_v}-linux-x64.zip"
+ install -Dm755 -d "${_zd}"
+ ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
+ sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," apps/desktop/forge.config.*
}
build() {
- cd "${srcdir}/${pkgname//-/.}/apps/desktop"
+ cd "${srcdir}/${pkgname//-/.}"
_set_build_env
_ensure_local_nvm
+ cd "${srcdir}/${pkgname//-/.}/apps/desktop"
cp .env.example .env
NODE_ENV=production pnpm update:main-hash
NODE_ENV=production pnpm build:electron-vite
- NODE_ENV=production pnpm build:electron-forge
+ cd "${srcdir}/${pkgname//-/.}"
+ NODE_ENV=production pnpm --filter=Folo build:electron-forge
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
+ cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-git}/"
install -Dm644 "${srcdir}/${pkgname//-/.}/apps/desktop/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 11:19:32 Medium 1
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion