franz

maintainer jasongodev · 149 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged npm and npx usage involves installing and running development tools (electron-builder, lerna, gulp) required to build the application from source; these are legitimate build dependencies for the project and not malicious remote code execution.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The flagged npm and npx usage involves installing and running development tools (electron-builder, lerna, gulp) required to build the application from source; these are legitimate build dependencies for the project and not malicious remote code execution.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:33 npm add -D electron-builder@latest

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:44 npx lerna run build
PKGBUILD:45 npx gulp build
PKGBUILD:47 npx electron-builder --linux deb --publish=never -c.electronDist=/usr/lib/"$_electron"

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Jason Go <jasongo@jasongo.net>
    
      2# Contributor: Giovanni 'ItachiSan' Santini <giovannisantini93@yahoo.it>
    
      3# Contributor: Filipe Laíns (FFY00) <lains@archlinux.org>
    
      4# Contributor: Pieter Goetschalckx <3.14.e.ter <at> gmail <dot> com>
    
      5
    
      6pkgname=franz
    
      7pkgver=5.11.0
    
      8pkgrel=2
    
      9epoch=1 # Due to the previous "_beta" naming
    
      10pkgdesc='Messaging app for WhatsApp, Slack, Telegram, Gmail, Hangouts and many many more.'
    
      11arch=('x86_64')
    
      12url='https://github.com/meetfranz/franz'
    
      13license=('Apache-2.0')
    
      14_electron='electron39'
    
      15depends=("$_electron")
    
      16makedepends=('git' 'nodejs' 'npm')
    
      17source=("git+$url.git#tag=v$pkgver"
    
      18        'franz.sh.in')
    
      19b2sums=('188b530974e5cc5c859d7d3dc06b42ab636c1fe8e4a9707b6a4938c59ebe6387b5417467f5d4742ebcf82076145cb919c82ee924ac3cf9253f4601e18224b466'
    
      20        '04f4015d858f38e847783bb8a7e1f774ae22a85ce7de174e5f24826934a4ffbeb978a52af7e20da39eb87a191b834d5b02ef19f121f2f8b4fcf175a2ac6bcb66')
    
      21
    
      22prepare() {
    
      23  cd franz
    
      24
    
      25  # Prevent Franz from being launched in development mode
    
      26  # This changes all the occurences where 'isDevMode' is set to a value.
    
      27  grep -lr 'isDevMode =' src | xargs sed -E 's|^(.*isDevMode =) .*$|\1 false|' -i
    
      28
    
      29  # Just make a stored deb file
    
      30  sed -i "s|^\s*compression:.*|compression: store|" electron-builder.yml
    
      31
    
      32  # Update electron-builder to work on latest system nodejs
    
      33  npm add -D electron-builder@latest
    
      34
    
      35  # Use system electron binaries
    
      36  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      37  
    
      38  npm install
    
      39}
    
      40
    
      41build() {
    
      42  cd franz
    
      43
    
      44  npx lerna run build
    
      45  npx gulp build
    
      46  # We prefer to build the deb format so we can have a ready made /usr/share/* much easily
    
      47  npx electron-builder --linux deb --publish=never -c.electronDist=/usr/lib/"$_electron"
    
      48
    
      49  # Then extract the deb file
    
      50  bsdtar -xf ./out/franz*_amd64.deb --include='data.tar*' -O | bsdtar -xf - -C "$srcdir"
    
      51}
    
      52
    
      53check() {
    
      54  cd franz
    
      55  npm run test
    
      56}
    
      57
    
      58package() {
    
      59  # 1. COPY THE BINARIES
    
      60  sed -i "s|@ELECTRON@|$_electron|" franz.sh.in
    
      61  install -Dm755 franz.sh.in "$pkgdir/usr/bin/franz"
    
      62  mkdir -p "$pkgdir/usr/lib/franz/"
    
      63  cp -dr --no-preserve=ownership ./opt/Franz/resources/* "$pkgdir/usr/lib/franz/"
    
      64  rm -f "$pkgdir/usr/lib/franz/"{apparmor-profile,default_app.asar,package-type}
    
      65
    
      66  # 2. COPY THE REST OF THE /usr/share/* from deb file
    
      67  sed -i 's|Exec=/opt/Franz/franz|Exec=/usr/bin/franz|' ./usr/share/applications/franz.desktop
    
      68  mkdir -p "$pkgdir/usr/share"
    
      69  cp -dr --no-preserve=ownership ./usr/share/* "$pkgdir/usr/share"
    
      70
    
      71  # 3. COPY DOCS AND LICENSE
    
      72  install -Dm644 -t "$pkgdir/usr/share/doc/franz/" ./franz/{CHANGELOG.md,CODE_OF_CONDUCT.md,CONTRIBUTING.md,README.md}
    
      73  install -Dm644 ./franz/LICENSE "$pkgdir/usr/share/licenses/franz/LICENSE"
    
      74
    
      75  # 4. COPY APPARMOR PROFILE
    
      76  sed -i 's|/opt/Franz/franz|/usr/bin/franz|' ./opt/Franz/resources/apparmor-profile
    
      77  install -Dm644 ./opt/Franz/resources/apparmor-profile "$pkgdir/etc/apparmor.d/franz"
    
      78}
    
      79

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3