fxxk-xuexiqiangguo-git

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a git source hosted on a mirror (fastgit.org) and downloads non-executable JSON/desktop files from the same; the yarn install is for building the project's own dependencies, not malicious external code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a git source hosted on a mirror (fastgit.org) and downloads non-executable JSON/desktop files from the same; the yarn install is for building the project's own dependencies, not malicious external code.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:33 yarn add electron-builder --dev

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "${pkgname}::git+https://hub.fastgit.org/fuck-xuexiqiangguo/source-code"
PKGBUILD:14 "arguments.json::https://raw.fastgit.org/zhanghua000/fuck-xuexiqiangguo-aur/main/arguments.json"

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Zhang Hua <https://github.com/zhanghua000>
    
      2# Contributer: Fuck-XuexiQiangguo <https://github.com/fuck-xuexiqiangguo>
    
      3pkgname=fxxk-xuexiqiangguo-git
    
      4pkgver="1.0.3"
    
      5pkgrel=1
    
      6pkgdesc="一款帮助成年人（或许未来包括小朋友）自动学刁的软件"
    
      7arch=( "aarch64" "x86_64" "i686" "armv7l" )
    
      8url="https://github.com/fuck-xuexiqiangguo/fuck-xuexiqiangguo"
    
      9licence=('MIT')
    
      10depends=( 'wget' 'unzip' 'gtk3' 'xorg-server-xvfb' 'libxss' 'alsa-lib' )
    
      11makedepends=( 'yarn' 'git' 'jq' )
    
      12source=(
    
      13	"${pkgname}::git+https://hub.fastgit.org/fuck-xuexiqiangguo/source-code"
    
      14	"arguments.json::https://raw.fastgit.org/zhanghua000/fuck-xuexiqiangguo-aur/main/arguments.json"
    
      15	"fuck-xuexiqiangguo.desktop::https://raw.fastgit.org/zhanghua000/fuck-xuexiqiangguo-aur/main/fuck-xuexiqiangguo.desktop"
    
      16)
    
      17md5sums=(
    
      18	"SKIP"
    
      19	"1dc893ed808ef14e0950a676342438e0"	
    
      20	"98884597ddd91fffc2c3e6e7b10137fc"
    
      21	
    
      22)
    
      23pkgver(){
    
      24	cd "${srcdir}/${pkgname}"
    
      25	jq .version package.json
    
      26	
    
      27}
    
      28prepare(){
    
      29	cd "${srcdir}/${pkgname}"
    
      30	install -D ${srcdir}/${pkgname}/logo.png build/logo.png
    
      31	install -D ${srcdir}/arguments.json arguments.json
    
      32	yarn install
    
      33	yarn add electron-builder --dev
    
      34	#sed -i '12s/3.0.17/$(jq .electron package.json)/' arguments.json
    
      35	sed -i '12s/3.0.17/9.3.4/' arguments.json
    
      36	jq -s '.[0] * .[1]' package.json arguments.json > package.json.new
    
      37	mv package.json.new package.json
    
      38}
    
      39build(){
    
      40	cd "${srcdir}/${pkgname}"
    
      41	yarn electron-builder build
    
      42}
    
      43package(){
    
      44	cd "${srcdir}/${pkgname}/dist"
    
      45	install -d -m755 ${pkgdir}/usr/bin
    
      46	install -d -m755 ${pkgdir}/usr/share/{applications,pixmaps}
    
      47	install -d -m755 ${pkgdir}/opt/fuck-xuexiqiangguo-git 
    
      48	cp -r `ls | grep linux*unpacked`/* ${pkgdir}/opt/fuck-xuexiqiangguo-git
    
      49	install -D ${srcdir}/fuck-xuexiqiangguo.desktop ${pkgdir}/usr/share/applications/fuck-xuexiqiangguo.desktop
    
      50	install -D ${srcdir}/${pkgname}/build/logo.png ${pkgdir}/usr/share/pixmaps/fuck-xuexiqiangguo.png
    
      51	ln -s /opt/fuck-xuexiqiangguo-git/fuck-xuexiqiangguo ${pkgdir}/usr/bin/fuck-xuexiqiangguo
    
      52}
    
      53
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3