gdevelop
LOW
maintainer arthuro555
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The flagged npm install and npx commands are used to build the project from its own source code, which is checked out from the official GitHub repository; this is standard and safe AUR packaging practice.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged npm install and npx commands are used to build the project from its own source code, which is checked out from the official GitHub repository; this is standard and safe AUR packaging practice.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:50
npm install --no-audit --no-fund --prefer-offline --include dev -
PKGBUILD:55
npm install --no-audit --no-fund --prefer-offline --include dev -
PKGBUILD:64
npm install --no-audit --no-fund --prefer-offline --include dev
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:56
NODE_ENV='development' npx -y update-browserslist-db@latest
PKGBUILD
4 offending line(s) highlighted
1
# Maintainer: Arthur "arthuro555" Pacaud <arthur.pacaud@hotmail.fr>
2
# Contributor: Popolon <popolon@popolon.org>
3
# Contributor: Paulequilibrio
4
# Contributor: JKA Network <contacto@jkanetwork.com>
5
# Contributor: Todor Imreorov for github <blurymind@gmail.com>
6
7
pkgname=gdevelop
8
pkgver=5.6.273
9
pkgrel=1
10
pkgdesc="A full-featured, open source game engine, allowing to create HTML5 with powerful visual scripting."
11
arch=(x86_64 armv7l arm64)
12
url=https://gdevelop.io
13
license=('MIT')
14
provides=("gdevelop=${pkgver}")
15
conflicts=('gdevelop-bin' 'gdevelop-git')
16
makedepends=('npm' 'git' 'clang')
17
_electron='electron41'
18
_emsdk='3.1.21'
19
depends=("$_electron")
20
source=("gdevelop::git+https://github.com/4ian/GDevelop.git#tag=v${pkgver}"
21
'emsdk::git+https://github.com/emscripten-core/emsdk.git'
22
'gdevelop.desktop')
23
sha256sums=('SKIP'
24
'SKIP'
25
'64fb52411e4fbc00237c589424d520d26e42199ed9a7b7e64d9dd375c6904e5c')
26
27
prepare() {
28
"$srcdir/emsdk/emsdk" install $_emsdk
29
"$srcdir/emsdk/emsdk" activate $_emsdk
30
}
31
32
build() {
33
EMSDK_QUIET=1 source "$srcdir/emsdk/emsdk_env.sh"
34
35
# Set basic build variables
36
export NODE_ENV='production' # Enables optimisations in JS build tools
37
export NODE_OPTIONS="--max-old-space-size=8192" # Allows NodeJS VM to allocate enough RAM to build the IDE
38
export CC=$(which clang)
39
export CXX=$(which clang++)
40
# Arch's clang package contains a patch that changes clang's default flags: https://wiki.archlinux.org/title/Clang#Stack_protector
41
# We disable this change, since this breaks emscripten.
42
export CXXFLAGS="-fno-stack-protector -w"
43
export CFLAGS="-fno-stack-protector -w"
44
# Arch sets default linker flags which are incompatible with wasm-ld.
45
export LDFLAGS=""
46
# Try to build despite the CMake file being written for a deprecated CMake version.
47
export CMAKE_POLICY_VERSION_MINIMUM="3.5"
48
49
cd "$srcdir/gdevelop/GDevelop.js"
50
npm install --no-audit --no-fund --prefer-offline --include dev
51
npm run build
52
53
cd "$srcdir/gdevelop/newIDE/app"
54
55
npm install --no-audit --no-fund --prefer-offline --include dev
56
NODE_ENV='development' npx -y update-browserslist-db@latest
57
58
cd "$srcdir/gdevelop/newIDE/electron-app"
59
60
local electronVer
61
electronVer="$(</usr/lib/$_electron/version)"
62
npm pkg set dependencies.electron=$electronVer
63
npm pkg set devDependencies.electron=$electronVer
64
npm install --no-audit --no-fund --prefer-offline --include dev
65
npm run build -- --linux dir --"${!CARCH}" -c.electronDist="/usr/lib/$_electron" -c.electronVersion="$electronVer"
66
}
67
68
package() {
69
mkdir -p "${pkgdir}/usr/share/gdevelop/"
70
cp -a --no-preserve=ownership "$srcdir/gdevelop/newIDE/electron-app/dist/linux-unpacked/resources/." "${pkgdir}/usr/share/gdevelop/"
71
chmod -R 755 "${pkgdir}/usr/share/gdevelop/"
72
73
mkdir -p "${pkgdir}/usr/bin/"
74
cat >>"${pkgdir}/usr/bin/gdevelop" <<EOD
75
#! /usr/bin/sh
76
ELECTRON_IS_DEV=0 exec $_electron /usr/share/gdevelop/app.asar "\$@"
77
EOD
78
chmod 755 "${pkgdir}/usr/bin/gdevelop"
79
80
install -Dm644 "$srcdir/gdevelop.desktop" "${pkgdir}/usr/share/applications/gdevelop.desktop"
81
install -Dm644 "$srcdir/gdevelop/newIDE/app/public/android-chrome-192x192.png" "$pkgdir/usr/share/pixmaps/gdevelop.png"
82
}
83
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |
| 2026-09-14 00:27:57 | Low | 3 |
| 2026-09-13 00:19:54 | Low | 3 |
| 2026-09-12 00:25:17 | Low | 3 |
| 2026-09-11 00:19:22 | Low | 3 |
| 2026-09-10 00:22:44 | Low | 3 |
| 2026-09-09 00:04:09 | Low | 3 |
| 2026-09-08 00:18:08 | Low | 3 |
| 2026-09-07 00:30:15 | Low | 3 |
| 2026-09-06 00:17:06 | Low | 3 |
| 2026-09-05 00:16:27 | Low | 3 |
| 2026-09-04 00:03:13 | Low | 3 |
| 2026-09-03 00:15:47 | Low | 3 |
| 2026-09-02 00:02:31 | Low | 3 |
| 2026-09-01 00:11:19 | Low | 3 |
| 2026-08-31 00:19:57 | Low | 3 |
| 2026-08-30 00:04:14 | Low | 3 |
| 2026-08-29 00:29:17 | Low | 3 |