franz
LOW
maintainer jasongodev
150 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The flagged npm and npx usage involves installing and running development tools (electron-builder, lerna, gulp) required to build the application from source; these are legitimate build dependencies for the project and not malicious remote code execution.
Triggered rules
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The flagged npm and npx usage involves installing and running development tools (electron-builder, lerna, gulp) required to build the application from source; these are legitimate build dependencies for the project and not malicious remote code execution.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:33
npm add -D electron-builder@latest
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:44
npx lerna run build -
PKGBUILD:45
npx gulp build -
PKGBUILD:47
npx electron-builder --linux deb --publish=never -c.electronDist=/usr/lib/"$_electron"
PKGBUILD
4 offending line(s) highlighted
1
# Maintainer: Jason Go <jasongo@jasongo.net>
2
# Contributor: Giovanni 'ItachiSan' Santini <giovannisantini93@yahoo.it>
3
# Contributor: Filipe Laíns (FFY00) <lains@archlinux.org>
4
# Contributor: Pieter Goetschalckx <3.14.e.ter <at> gmail <dot> com>
5
6
pkgname=franz
7
pkgver=5.11.0
8
pkgrel=2
9
epoch=1 # Due to the previous "_beta" naming
10
pkgdesc='Messaging app for WhatsApp, Slack, Telegram, Gmail, Hangouts and many many more.'
11
arch=('x86_64')
12
url='https://github.com/meetfranz/franz'
13
license=('Apache-2.0')
14
_electron='electron39'
15
depends=("$_electron")
16
makedepends=('git' 'nodejs' 'npm')
17
source=("git+$url.git#tag=v$pkgver"
18
'franz.sh.in')
19
b2sums=('188b530974e5cc5c859d7d3dc06b42ab636c1fe8e4a9707b6a4938c59ebe6387b5417467f5d4742ebcf82076145cb919c82ee924ac3cf9253f4601e18224b466'
20
'04f4015d858f38e847783bb8a7e1f774ae22a85ce7de174e5f24826934a4ffbeb978a52af7e20da39eb87a191b834d5b02ef19f121f2f8b4fcf175a2ac6bcb66')
21
22
prepare() {
23
cd franz
24
25
# Prevent Franz from being launched in development mode
26
# This changes all the occurences where 'isDevMode' is set to a value.
27
grep -lr 'isDevMode =' src | xargs sed -E 's|^(.*isDevMode =) .*$|\1 false|' -i
28
29
# Just make a stored deb file
30
sed -i "s|^\s*compression:.*|compression: store|" electron-builder.yml
31
32
# Update electron-builder to work on latest system nodejs
33
npm add -D electron-builder@latest
34
35
# Use system electron binaries
36
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
37
38
npm install
39
}
40
41
build() {
42
cd franz
43
44
npx lerna run build
45
npx gulp build
46
# We prefer to build the deb format so we can have a ready made /usr/share/* much easily
47
npx electron-builder --linux deb --publish=never -c.electronDist=/usr/lib/"$_electron"
48
49
# Then extract the deb file
50
bsdtar -xf ./out/franz*_amd64.deb --include='data.tar*' -O | bsdtar -xf - -C "$srcdir"
51
}
52
53
check() {
54
cd franz
55
npm run test
56
}
57
58
package() {
59
# 1. COPY THE BINARIES
60
sed -i "s|@ELECTRON@|$_electron|" franz.sh.in
61
install -Dm755 franz.sh.in "$pkgdir/usr/bin/franz"
62
mkdir -p "$pkgdir/usr/lib/franz/"
63
cp -dr --no-preserve=ownership ./opt/Franz/resources/* "$pkgdir/usr/lib/franz/"
64
rm -f "$pkgdir/usr/lib/franz/"{apparmor-profile,default_app.asar,package-type}
65
66
# 2. COPY THE REST OF THE /usr/share/* from deb file
67
sed -i 's|Exec=/opt/Franz/franz|Exec=/usr/bin/franz|' ./usr/share/applications/franz.desktop
68
mkdir -p "$pkgdir/usr/share"
69
cp -dr --no-preserve=ownership ./usr/share/* "$pkgdir/usr/share"
70
71
# 3. COPY DOCS AND LICENSE
72
install -Dm644 -t "$pkgdir/usr/share/doc/franz/" ./franz/{CHANGELOG.md,CODE_OF_CONDUCT.md,CONTRIBUTING.md,README.md}
73
install -Dm644 ./franz/LICENSE "$pkgdir/usr/share/licenses/franz/LICENSE"
74
75
# 4. COPY APPARMOR PROFILE
76
sed -i 's|/opt/Franz/franz|/usr/bin/franz|' ./opt/Franz/resources/apparmor-profile
77
install -Dm644 ./opt/Franz/resources/apparmor-profile "$pkgdir/etc/apparmor.d/franz"
78
}
79
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |
| 2026-09-14 00:27:57 | Low | 3 |
| 2026-09-13 00:19:54 | Low | 3 |
| 2026-09-12 00:25:17 | Low | 3 |
| 2026-09-11 00:19:22 | Low | 3 |
| 2026-09-10 00:22:44 | Low | 3 |
| 2026-09-09 00:04:09 | Low | 3 |
| 2026-09-08 00:18:08 | Low | 3 |
| 2026-09-07 00:30:15 | Low | 3 |
| 2026-09-06 00:17:06 | Low | 3 |
| 2026-09-05 00:16:27 | Low | 3 |
| 2026-09-04 00:03:13 | Low | 3 |
| 2026-09-03 00:15:47 | Low | 3 |
| 2026-09-02 00:02:31 | Low | 3 |
| 2026-09-01 00:11:19 | Low | 3 |
| 2026-08-31 00:19:57 | Low | 3 |
| 2026-08-30 00:04:14 | Low | 3 |
| 2026-08-29 00:29:17 | Low | 3 |