gdlauncher-git

maintainer BlazingBlast · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx commands (craco, webpack) are used to build the project from its own source and are not executing arbitrary remote code; the sources are from the project's official repository and the build process is standard for Electron apps.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx commands (craco, webpack) are used to build the project from its own source and are not executing arbitrary remote code; the sources are from the project's official repository and the build process is standard for Electron apps.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:51 npx craco build
PKGBUILD:52 npx webpack --config scripts/electronWebpackConfig.js

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Blazingblast <lukabijma1@gmail.com>
    
      2# Contributor: ObserverOfTime <chronobserver@disroot.org>
    
      3
    
      4pkgname=gdlauncher-git
    
      5pkgver=1.1.30.r1.g97c33ac7
    
      6pkgrel=2
    
      7pkgdesc='Modded Minecraft launcher built with Rust and Electron/React (git version)'
    
      8arch=('x86_64')
    
      9url='https://gdevs.io'
    
      10license=('GPL3')
    
      11provides=('gdlauncher')
    
      12conflicts=('gdlauncher' 'gdlauncher-appimage' 'gdlauncher-bin' 'gdlauncher-classic')
    
      13depends=('electron' 'libnotify' 'libxss' 'libxtst' 'libindicator-gtk3' 'libappindicator-gtk3' 'p7zip')
    
      14makedepends=('git' 'nodejs>=17' 'npm' 'rust')
    
      15source=('git+https://github.com/gorilla-devs/GDLauncher.git'
    
      16        'gdlauncher.png::https://avatars0.githubusercontent.com/u/49373890?s=256'
    
      17        'use-system-7za-and-disable-updater.patch')
    
      18sha256sums=('SKIP'
    
      19            'c77b67c7afe1d0e3a4cd11aaf262d2547f91773fd8afe2867463ea1b01e1cfc4'
    
      20            '300675d00b00681c12870cf3832e4e3bcbfaf71ccfd01c0ee474bc2887b8b666')
    
      21
    
      22pkgver() {
    
      23  cd "$srcdir"/GDLauncher
    
      24
    
      25  git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      26}
    
      27
    
      28prepare() {
    
      29  cd "$srcdir"/GDLauncher
    
      30
    
      31  sed -i package.json \
    
      32    -e '/electron-updater/d;/7zip-bin/d' \
    
      33    -e 's$public/electron.js$build/electron.js$'
    
      34  sed -i craco.config.js \
    
      35    -e "/class-properties/a '@babel\/plugin-proposal-private-methods'," \
    
      36    -e "/class-properties/a '@babel\/plugin-proposal-private-property-in-object',"
    
      37  patch -p1 -i ../use-system-7za-and-disable-updater.patch
    
      38}
    
      39
    
      40build() {
    
      41  cd "$srcdir"/GDLauncher
    
      42
    
      43  export CARGO_HOME="$srcdir"/cargo-cache
    
      44  npm i --legacy-peer-deps --cache="$srcdir"/npm-cache
    
      45
    
      46  export CI=false \
    
      47         APP_TYPE=electron \
    
      48         NODE_ENV=production \
    
      49         REACT_APP_RELEASE_TYPE=setup \
    
      50         NODE_OPTIONS="--openssl-legacy-provider"
    
      51  npx craco build
    
      52  npx webpack --config scripts/electronWebpackConfig.js
    
      53}
    
      54
    
      55package() {
    
      56  cd "$srcdir"/GDLauncher
    
      57
    
      58  # copy runtime files
    
      59  mkdir -p "$pkgdir"/usr/lib/gdlauncher
    
      60  rm build/installer{.nsh,{Header,Sidebar}.bmp}
    
      61  cp -r package.json build "$pkgdir"/usr/lib/gdlauncher
    
      62
    
      63  # copy icon
    
      64  mkdir -p "$pkgdir"/usr/share/icons/hicolor/256x256/apps
    
      65  cp ../gdlauncher.png "$pkgdir"/usr/share/icons/hicolor/256x256/apps
    
      66
    
      67  # create run script
    
      68  mkdir -p "$pkgdir"/usr/bin
    
      69  printf >"$pkgdir"/usr/bin/gdlauncher \
    
      70      '#!/bin/sh\n\nexec electron /usr/lib/gdlauncher "$@"\n'
    
      71  chmod a+x "$pkgdir"/usr/bin/gdlauncher
    
      72
    
      73  # create desktop file
    
      74  mkdir -p "$pkgdir"/usr/share/applications
    
      75  cat >"$pkgdir"/usr/share/applications/gdlauncher.desktop <<'EOF'
    
      76[Desktop Entry]
    
      77Name=GDLauncher
    
      78Comment=A Custom Minecraft Launcher
    
      79Exec=/usr/bin/gdlauncher %U
    
      80Terminal=false
    
      81StartupWMClass=GDLauncher
    
      82Icon=gdlauncher
    
      83Categories=Game;
    
      84Type=Application
    
      85EOF
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2