gdlauncher-git

LOW

maintainer BlazingBlast 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx commands (craco, webpack) are used to build the project from its own source and are not executing arbitrary remote code; the sources are from the project's official repository and the build process is standard for Electron apps.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx commands (craco, webpack) are used to build the project from its own source and are not executing arbitrary remote code; the sources are from the project's official repository and the build process is standard for Electron apps.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:51 npx craco build
PKGBUILD:52 npx webpack --config scripts/electronWebpackConfig.js

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Blazingblast <lukabijma1@gmail.com>
    
      2# Contributor: ObserverOfTime <chronobserver@disroot.org>
    
      3
    
      4pkgname=gdlauncher-git
    
      5pkgver=1.1.30.r1.g97c33ac7
    
      6pkgrel=2
    
      7pkgdesc='Modded Minecraft launcher built with Rust and Electron/React (git version)'
    
      8arch=('x86_64')
    
      9url='https://gdevs.io'
    
      10license=('GPL3')
    
      11provides=('gdlauncher')
    
      12conflicts=('gdlauncher' 'gdlauncher-appimage' 'gdlauncher-bin' 'gdlauncher-classic')
    
      13depends=('electron' 'libnotify' 'libxss' 'libxtst' 'libindicator-gtk3' 'libappindicator-gtk3' 'p7zip')
    
      14makedepends=('git' 'nodejs>=17' 'npm' 'rust')
    
      15source=('git+https://github.com/gorilla-devs/GDLauncher.git'
    
      16        'gdlauncher.png::https://avatars0.githubusercontent.com/u/49373890?s=256'
    
      17        'use-system-7za-and-disable-updater.patch')
    
      18sha256sums=('SKIP'
    
      19            'c77b67c7afe1d0e3a4cd11aaf262d2547f91773fd8afe2867463ea1b01e1cfc4'
    
      20            '300675d00b00681c12870cf3832e4e3bcbfaf71ccfd01c0ee474bc2887b8b666')
    
      21
    
      22pkgver() {
    
      23  cd "$srcdir"/GDLauncher
    
      24
    
      25  git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      26}
    
      27
    
      28prepare() {
    
      29  cd "$srcdir"/GDLauncher
    
      30
    
      31  sed -i package.json \
    
      32    -e '/electron-updater/d;/7zip-bin/d' \
    
      33    -e 's$public/electron.js$build/electron.js$'
    
      34  sed -i craco.config.js \
    
      35    -e "/class-properties/a '@babel\/plugin-proposal-private-methods'," \
    
      36    -e "/class-properties/a '@babel\/plugin-proposal-private-property-in-object',"
    
      37  patch -p1 -i ../use-system-7za-and-disable-updater.patch
    
      38}
    
      39
    
      40build() {
    
      41  cd "$srcdir"/GDLauncher
    
      42
    
      43  export CARGO_HOME="$srcdir"/cargo-cache
    
      44  npm i --legacy-peer-deps --cache="$srcdir"/npm-cache
    
      45
    
      46  export CI=false \
    
      47         APP_TYPE=electron \
    
      48         NODE_ENV=production \
    
      49         REACT_APP_RELEASE_TYPE=setup \
    
      50         NODE_OPTIONS="--openssl-legacy-provider"
    
      51  npx craco build
    
      52  npx webpack --config scripts/electronWebpackConfig.js
    
      53}
    
      54
    
      55package() {
    
      56  cd "$srcdir"/GDLauncher
    
      57
    
      58  # copy runtime files
    
      59  mkdir -p "$pkgdir"/usr/lib/gdlauncher
    
      60  rm build/installer{.nsh,{Header,Sidebar}.bmp}
    
      61  cp -r package.json build "$pkgdir"/usr/lib/gdlauncher
    
      62
    
      63  # copy icon
    
      64  mkdir -p "$pkgdir"/usr/share/icons/hicolor/256x256/apps
    
      65  cp ../gdlauncher.png "$pkgdir"/usr/share/icons/hicolor/256x256/apps
    
      66
    
      67  # create run script
    
      68  mkdir -p "$pkgdir"/usr/bin
    
      69  printf >"$pkgdir"/usr/bin/gdlauncher \
    
      70      '#!/bin/sh\n\nexec electron /usr/lib/gdlauncher "$@"\n'
    
      71  chmod a+x "$pkgdir"/usr/bin/gdlauncher
    
      72
    
      73  # create desktop file
    
      74  mkdir -p "$pkgdir"/usr/share/applications
    
      75  cat >"$pkgdir"/usr/share/applications/gdlauncher.desktop <<'EOF'
    
      76[Desktop Entry]
    
      77Name=GDLauncher
    
      78Comment=A Custom Minecraft Launcher
    
      79Exec=/usr/bin/gdlauncher %U
    
      80Terminal=false
    
      81StartupWMClass=GDLauncher
    
      82Icon=gdlauncher
    
      83Categories=Game;
    
      84Type=Application
    
      85EOF
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2