fxxk-xuexiqiangguo-git

LOW

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package builds from a git source hosted on a mirror (fastgit.org) and downloads non-executable JSON/desktop files from the same; the yarn install is for building the project's own dependencies, not malicious external code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a git source hosted on a mirror (fastgit.org) and downloads non-executable JSON/desktop files from the same; the yarn install is for building the project's own dependencies, not malicious external code.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:33 yarn add electron-builder --dev

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "${pkgname}::git+https://hub.fastgit.org/fuck-xuexiqiangguo/source-code"
PKGBUILD:14 "arguments.json::https://raw.fastgit.org/zhanghua000/fuck-xuexiqiangguo-aur/main/arguments.json"

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Zhang Hua <https://github.com/zhanghua000>
    
      2# Contributer: Fuck-XuexiQiangguo <https://github.com/fuck-xuexiqiangguo>
    
      3pkgname=fxxk-xuexiqiangguo-git
    
      4pkgver="1.0.3"
    
      5pkgrel=1
    
      6pkgdesc="一款帮助成年人（或许未来包括小朋友）自动学刁的软件"
    
      7arch=( "aarch64" "x86_64" "i686" "armv7l" )
    
      8url="https://github.com/fuck-xuexiqiangguo/fuck-xuexiqiangguo"
    
      9licence=('MIT')
    
      10depends=( 'wget' 'unzip' 'gtk3' 'xorg-server-xvfb' 'libxss' 'alsa-lib' )
    
      11makedepends=( 'yarn' 'git' 'jq' )
    
      12source=(
    
      13	"${pkgname}::git+https://hub.fastgit.org/fuck-xuexiqiangguo/source-code"
    
      14	"arguments.json::https://raw.fastgit.org/zhanghua000/fuck-xuexiqiangguo-aur/main/arguments.json"
    
      15	"fuck-xuexiqiangguo.desktop::https://raw.fastgit.org/zhanghua000/fuck-xuexiqiangguo-aur/main/fuck-xuexiqiangguo.desktop"
    
      16)
    
      17md5sums=(
    
      18	"SKIP"
    
      19	"1dc893ed808ef14e0950a676342438e0"	
    
      20	"98884597ddd91fffc2c3e6e7b10137fc"
    
      21	
    
      22)
    
      23pkgver(){
    
      24	cd "${srcdir}/${pkgname}"
    
      25	jq .version package.json
    
      26	
    
      27}
    
      28prepare(){
    
      29	cd "${srcdir}/${pkgname}"
    
      30	install -D ${srcdir}/${pkgname}/logo.png build/logo.png
    
      31	install -D ${srcdir}/arguments.json arguments.json
    
      32	yarn install
    
      33	yarn add electron-builder --dev
    
      34	#sed -i '12s/3.0.17/$(jq .electron package.json)/' arguments.json
    
      35	sed -i '12s/3.0.17/9.3.4/' arguments.json
    
      36	jq -s '.[0] * .[1]' package.json arguments.json > package.json.new
    
      37	mv package.json.new package.json
    
      38}
    
      39build(){
    
      40	cd "${srcdir}/${pkgname}"
    
      41	yarn electron-builder build
    
      42}
    
      43package(){
    
      44	cd "${srcdir}/${pkgname}/dist"
    
      45	install -d -m755 ${pkgdir}/usr/bin
    
      46	install -d -m755 ${pkgdir}/usr/share/{applications,pixmaps}
    
      47	install -d -m755 ${pkgdir}/opt/fuck-xuexiqiangguo-git 
    
      48	cp -r `ls | grep linux*unpacked`/* ${pkgdir}/opt/fuck-xuexiqiangguo-git
    
      49	install -D ${srcdir}/fuck-xuexiqiangguo.desktop ${pkgdir}/usr/share/applications/fuck-xuexiqiangguo.desktop
    
      50	install -D ${srcdir}/${pkgname}/build/logo.png ${pkgdir}/usr/share/pixmaps/fuck-xuexiqiangguo.png
    
      51	ln -s /opt/fuck-xuexiqiangguo-git/fuck-xuexiqiangguo ${pkgdir}/usr/bin/fuck-xuexiqiangguo
    
      52}
    
      53
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	3
2026-09-16 00:03:17	Low	3
2026-09-15 00:25:31	Low	3
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 00:19:22	Low	3
2026-09-10 00:22:44	Low	3
2026-09-09 00:04:09	Low	3
2026-09-08 00:18:08	Low	3
2026-09-07 00:30:15	Low	3
2026-09-06 00:17:06	Low	3
2026-09-05 00:16:27	Low	3
2026-09-04 00:03:13	Low	3
2026-09-03 00:15:47	Low	3
2026-09-02 00:02:31	Low	3
2026-09-01 00:11:19	Low	3
2026-08-31 00:19:57	Low	3
2026-08-30 00:04:14	Low	3
2026-08-29 00:29:17	Low	3