fusionkit-git

LOW
maintainer zxp19821005 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package builds from source using project-owned dependencies and tools; flagged npm/pnpm/npx usage is part of the normal build process for a Node.js/Electron application, not execution of untrusted remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The package builds from source using project-owned dependencies and tools; flagged npm/pnpm/npx usage is part of the normal build process for a Node.js/Electron application, not execution of untrusted remote code.

  • PKGBUILD:96 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:130 pnpm add -D node-gyp node-pty node-addon-api
Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:143 npx tsc
  • PKGBUILD:144 npx vite build

PKGBUILD

4 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=fusionkit-git
3_pkgname=FusionKit
4pkgver=0.5.2.r0.g4ec0f3e
5_electronversion=41
6_nodeversion=24
7pkgrel=1
8pkgdesc="Desktop toolbox,integrated with subtitle processing(AI translation,format conversion),batch renaming of files,paid music decryption(to FLAC/MP3) and other practical functions."
9arch=('any')
10url="https://github.com/QiuYeDx/FusionKit"
11license=('MIT')
12provides=("${pkgname%-git}=${pkgver%.r*}")
13conflicts=("${pkgname%-git}")
14depends=(
15 "electron${_electronversion}"
16)
17makedepends=(
18 'npm'
19 'nvm'
20 'git'
21 'gendesk'
22 'icoutils'
23 'jq'
24)
25source=(
26 "${pkgname//-/.}::git+${url}.git"
27 "${pkgname%-git}.js"
28 "${pkgname%-git}.sh"
29)
30sha256sums=('SKIP'
31 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
32 '9417ba033cfc980d6723978dc5fca100cbec6da78e5494f9e64960e4efec8c21')
33_get_project_dir() {
34 local d
35 while IFS= read -r d; do
36 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
37 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
38}
39pkgver() {
40 cd "$(_get_project_dir)"
41 set -o pipefail
42 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
43 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
44}
45_ensure_local_nvm() {
46 local NVM_DIR="${srcdir}/.nvm"
47 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
48 nvm install "${_nodeversion}"
49 nvm use "${_nodeversion}"
50}
51_get_app_dir() {
52 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
53 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
54}
55_get_electron_version() {
56 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
57 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
58 | grep -oE '[0-9]+' | head -1)
59 [[ -z "${_elec_ver}" ]] && return 1
60 (( _elec_ver == _electronversion )) && c=32 || c=31
61 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
62}
63_set_build_env() {
64 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
65 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
66 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
67 export ELECTRON_BUILDER_OFFLINE=true
68 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
69 export HOME="${srcdir}/.home"
70 export XDG_CACHE_HOME="${HOME}/.cache"
71 export XDG_CONFIG_HOME="${HOME}/.config"
72 export XDG_DATA_HOME="${HOME}/.local/share"
73 export XDG_STATE_HOME="${HOME}/.local/state"
74 export PNPM_HOME="${HOME}/.pnpm/bin"
75 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
76 export pnpm_config_store_dir="${HOME}/.pnpm_store"
77 export pnpm_config_global_dir="${HOME}/.pnpm/global"
78 export pnpm_config_state_dir="${HOME}/.pnpm/state"
79 export pnpm_config_node_linker=hoisted
80 export pnpm_config_minimum_release_age=0
81 export pnpm_config_update_notifier=false
82 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
83 export COREPACK_HOME="${HOME}/.corepack"
84 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
85 export PATH="${PNPM_HOME}:${PATH}"
86 local _pnpmver=""
87 local _pkgjson="$(_get_project_dir)/package.json"
88 if [ -f "${_pkgjson}" ]; then
89 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
90 if [ -z "${_pnpmver}" ]; then
91 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
92 fi
93 fi
94 _pnpmver="8.7.0"
95 if [ -n "${_pnpmver}" ]; then
96 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
97 --registry "${COREPACK_NPM_REGISTRY}"
98 fi
99}
100prepare() {
101 cd "$(_get_project_dir)"
102 _get_electron_version
103 sed -i -e "
104 s/@electronversion@/${_electronversion}/g
105 s/@appname@/${pkgname%-git}/g
106 " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
107 gendesk -q -f -n \
108 --pkgname="${pkgname%-git}" \
109 --pkgdesc="${pkgdesc}" \
110 --categories="Utility" \
111 --name="${_pkgname}" \
112 --exec="${pkgname%-git} %U"
113 _ensure_local_nvm
114 _set_build_env
115 icotool -x "public/${_pkgname}.ico" -o "public/${pkgname%-git}.png"
116 cp "public/${_pkgname}.ico" "public/favicon.ico"
117 sed -i "s/${_pkgname}.ico/${pkgname%-git}.png/g" electron/main/index.ts
118 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
119 # 移除 Linux 构建不需要的 beforePack 钩子和 extraResources（仅 macOS/Windows 需要）
120 python3 -c "
121import json
122with open('electron-builder.json', 'r') as f:
123 config = json.load(f)
124config.pop('beforePack', None)
125config.pop('extraResources', None)
126with open('electron-builder.json', 'w') as f:
127 json.dump(config, f, indent=2)
128"
129 export NODE_ENV=development
130 pnpm add -D node-gyp node-pty node-addon-api
131 sed -i '/"esModuleInterop"/d' tsconfig.json
132 sed -i 's/"moduleResolution": "Node"/"moduleResolution": "bundler"/' tsconfig.json
133 sed -i '/"baseUrl"/d' tsconfig.json
134 sed -i 's|"src/\*"|"./src/*"|' tsconfig.json
135 pnpm install
136}
137build() {
138 cd "$(_get_project_dir)"
139 _ensure_local_nvm
140 _set_build_env
141 export NODE_ENV=production
142 node scripts/translation-knowledge/build-artifacts.mjs
143 npx tsc
144 npx vite build
145 node scripts/check-preload-bundle.mjs
146 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.subtitle-studio.json"
147 rm -rf "$(_get_app_dir)/resources/default_app.asar"
148}
149package() {
150 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
151 install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
152 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
153 install -Dm644 "$(_get_project_dir)/public/${pkgname%-git}.png" -t "${pkgdir}/usr/share/pixmaps"
154 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
155 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
156}
157

Changes since previous scan

--- PKGBUILD @ 2026-10-26 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=fusionkit-git
_pkgname=FusionKit
-pkgver=0.4.0.r1.gf80a823
+pkgver=0.5.2.r0.g4ec0f3e
_electronversion=41
_nodeversion=24
pkgrel=1
@@ -24,10 +24,12 @@
)
source=(
"${pkgname//-/.}::git+${url}.git"
+ "${pkgname%-git}.js"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ '9417ba033cfc980d6723978dc5fca100cbec6da78e5494f9e64960e4efec8c21')
_get_project_dir() {
local d
while IFS= read -r d; do
@@ -35,16 +37,28 @@
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
}
pkgver() {
- cd "$(_get_project_dir)"
- set -o pipefail
- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g;s/public.beta.//g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
+}
+_get_app_dir() {
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
+}
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
@@ -77,23 +91,11 @@
_pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
fi
fi
- # 强制使用 pnpm 8.7.0（项目要求）
- _pnpmver="8.7.0"
+ _pnpmver="8.7.0"
if [ -n "${_pnpmver}" ]; then
npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
--registry "${COREPACK_NPM_REGISTRY}"
fi
-}
-_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
-}
-_get_electron_version() {
- _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
- | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
- | grep -oE '[0-9]+' | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- (( _elec_ver == _electronversion )) && c=32 || c=31
- echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
prepare() {
cd "$(_get_project_dir)"
@@ -101,7 +103,7 @@
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- " "${srcdir}/${pkgname%-git}.sh"
+ " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
gendesk -q -f -n \
--pkgname="${pkgname%-git}" \
--pkgdesc="${pkgdesc}" \
@@ -110,12 +112,10 @@
--exec="${pkgname%-git} %U"
_ensure_local_nvm
_set_build_env
- find src -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
icotool -x "public/${_pkgname}.ico" -o "public/${pkgname%-git}.png"
cp "public/${_pkgname}.ico" "public/favicon.ico"
sed -i "s/${_pkgname}.ico/${pkgname%-git}.png/g" electron/main/index.ts
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
- rm -rf pnpm-lock.yaml pnpm-workspace.yaml
# 移除 Linux 构建不需要的 beforePack 钩子和 extraResources（仅 macOS/Windows 需要）
python3 -c "
import json
@@ -128,8 +128,6 @@
"
export NODE_ENV=development
pnpm add -D node-gyp node-pty node-addon-api
- #pnpm add -D typescript@latest
- # 修复 tsconfig.json 以兼容 TypeScript 7.x
sed -i '/"esModuleInterop"/d' tsconfig.json
sed -i 's/"moduleResolution": "Node"/"moduleResolution": "bundler"/' tsconfig.json
sed -i '/"baseUrl"/d' tsconfig.json
@@ -146,13 +144,12 @@
npx vite build
node scripts/check-preload-bundle.mjs
pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.subtitle-studio.json"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir="$(_get_app_dir)"
- rm -rf "${_app_dir}/resources/default_app.asar"
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
install -Dm644 "$(_get_project_dir)/public/${pkgname%-git}.png" -t "${pkgdir}/usr/share/pixmaps"
install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 3
2026-10-31 00:07:41 Low 3
2026-10-30 00:29:30 Low 3
2026-10-29 00:13:55 Low 3
2026-10-28 00:06:54 Low 3
2026-10-27 00:23:28 Low 3
2026-10-26 15:45:54 Medium 2
2026-10-26 00:12:40 Medium 3
2026-10-25 00:20:48 Medium 3
2026-10-24 00:14:55 Medium 3
2026-10-23 00:02:19 Medium 3
2026-10-22 00:13:10 Medium 3
2026-10-21 00:12:50 Medium 3
2026-10-20 00:10:31 Medium 3
2026-10-19 00:03:55 Medium 3
2026-10-18 00:06:55 Medium 3
2026-10-17 00:21:55 Medium 3
2026-10-16 00:12:47 Medium 3
2026-10-15 00:28:05 Medium 3
2026-10-14 00:06:47 Medium 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion