ghost-chat
MEDIUM
maintainer zxp19821005
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The PKGBUILD installs pnpm via npm using a version derived from package.json, which is a remote dependency resolution via an unverifiable source, posing a supply-chain risk if the registry is compromised or spoofed.
Triggered rules
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:104
go install github.com/wailsapp/wails/v3/cmd/wails3@latest
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD installs pnpm via npm using a version derived from package.json, which is a remote dependency resolution via an unverifiable source, posing a supply-chain risk if the registry is compromised or spoofed.
-
PKGBUILD:88
npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=ghost-chat
3
_pkgname=GhostChat
4
pkgver=4.9.0
5
_nodeversion=24
6
pkgrel=1
7
pkgdesc="Transparent chat overlay for streamers. Twitch, YouTube, and Kick in one window."
8
arch=('any')
9
url="https://getghostchat.com/"
10
_ghurl="https://github.com/Enubia/ghost-chat"
11
license=('LicenseRef-DBAD')
12
conflicts=("${pkgname}")
13
depends=(
14
'webkitgtk-6.0'
15
'gtk3'
16
)
17
makedepends=(
18
'pnpm'
19
'npm'
20
'gendesk'
21
'go'
22
'nvm'
23
'git'
24
)
25
source=(
26
"${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
27
"modifiers_linux.go"
28
)
29
sha256sums=('a1de9e2788ea271949669cc2b8aca0f08a87f4426a777e9247002a1adbab96ca'
30
'131035c2816a154359af542ff002e53f48419311e6ab083eb9f944a5e2f0d24c')
31
_get_project_dir() {
32
local d
33
while IFS= read -r d; do
34
find "$d" -name "go.mod" -o -name "go.sum" 2>/dev/null | grep -q . && { echo "$d"; return; }
35
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
36
}
37
_ensure_local_nvm() {
38
local NVM_DIR="${srcdir}/.nvm"
39
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
40
nvm install "${_nodeversion}"
41
nvm use "${_nodeversion}"
42
}
43
_set_go_build_env() {
44
export HOME="${srcdir}/.home"
45
export GOPATH="${HOME}/go"
46
export GOCACHE="${HOME}/go-build"
47
export GOENV="${HOME}/go/env"
48
export XDG_CONFIG_HOME="${HOME}/.config"
49
export XDG_CACHE_HOME="${HOME}/.cache"
50
export CGO_CPPFLAGS="${CPPFLAGS}"
51
export CGO_CFLAGS="${CFLAGS}"
52
export CGO_CXXFLAGS="${CXXFLAGS}"
53
export CGO_LDFLAGS="${LDFLAGS}"
54
export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
55
export GOTOOLCHAIN=local
56
export GOWORK=off
57
mkdir -p "${HOME}" "${GOCACHE}" "${XDG_CONFIG_HOME}" "${XDG_CACHE_HOME}" "$(dirname "${GOENV}")"
58
: > "${GOENV}"
59
export PATH="${GOPATH}/bin:${PATH}"
60
}
61
_set_pnpm_build_env() {
62
export HOME="${srcdir}/.home"
63
export XDG_CACHE_HOME="${HOME}/.cache"
64
export XDG_CONFIG_HOME="${HOME}/.config"
65
export XDG_DATA_HOME="${HOME}/.local/share"
66
export XDG_STATE_HOME="${HOME}/.local/state"
67
export PNPM_HOME="${HOME}/.pnpm/bin"
68
export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
69
export pnpm_config_store_dir="${HOME}/.pnpm_store"
70
export pnpm_config_global_dir="${HOME}/.pnpm/global"
71
export pnpm_config_state_dir="${HOME}/.pnpm/state"
72
export pnpm_config_node_linker=hoisted
73
export pnpm_config_minimum_release_age=0
74
export pnpm_config_update_notifier=false
75
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
76
export COREPACK_HOME="${HOME}/.corepack"
77
mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
78
export PATH="${PNPM_HOME}:${PATH}"
79
local _pnpmver=""
80
local _pkgjson="$(_get_project_dir)/package.json"
81
if [ -f "${_pkgjson}" ]; then
82
_pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
83
if [ -z "${_pnpmver}" ]; then
84
_pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
85
fi
86
fi
87
if [ -n "${_pnpmver}" ]; then
88
npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
89
--registry "${COREPACK_NPM_REGISTRY}"
90
fi
91
}
92
prepare() {
93
cd "$(_get_project_dir)"
94
gendesk -f -n -q \
95
--pkgname="${pkgname}" \
96
--pkgdesc="${pkgdesc}" \
97
--categories="Utility" \
98
--name="${_pkgname}" \
99
--exec="${pkgname} %U"
100
_ensure_local_nvm
101
_set_pnpm_build_env
102
_set_go_build_env
103
cp "${srcdir}/modifiers_linux.go" internal/hotkey/modifiers_linux.go
104
go install github.com/wailsapp/wails/v3/cmd/wails3@latest
105
cd "$(_get_project_dir)/frontend"
106
export NODE_ENV=development
107
pnpm install
108
}
109
build() {
110
cd "$(_get_project_dir)/build"
111
_ensure_local_nvm
112
_set_pnpm_build_env
113
_set_go_build_env
114
go mod tidy
115
wails3 generate bindings -f '-tags production -trimpath -buildvcs=false -ldflags="-w -s -X main.version=v4.0.1"' -clean=true -ts
116
cd "$(_get_project_dir)/frontend"
117
export NODE_ENV=production
118
pnpm run build
119
cd "$(_get_project_dir)"
120
go build -tags production -trimpath -buildvcs=false -ldflags="-w -s -X main.version=v4.0.1" -o bin/ghost-chat
121
}
122
package() {
123
install -Dm755 "$(_get_project_dir)/bin/${pkgname}" -t "${pkgdir}/usr/bin"
124
install -Dm644 "$(_get_project_dir)/build/appicon.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
125
install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
126
install -Dm644 "$(_get_project_dir)/LICENSE.md" -t "${pkgdir}/usr/share/licenses/${pkgname}"
127
}
128
Changes since previous scan
--- PKGBUILD @ 2026-10-30 00:29+++ PKGBUILD @ 2026-11-01 00:21@@ -1,7 +1,7 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> pkgname=ghost-chat _pkgname=GhostChat-pkgver=4.8.0+pkgver=4.9.0 _nodeversion=24 pkgrel=1 pkgdesc="Transparent chat overlay for streamers. Twitch, YouTube, and Kick in one window."@@ -26,7 +26,7 @@ "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz" "modifiers_linux.go" )-sha256sums=('fb4c02c2ad7a5997fd7f37e0b480b51d6493807cb978a9b808243e9bd4c9d65f'+sha256sums=('a1de9e2788ea271949669cc2b8aca0f08a87f4426a777e9247002a1adbab96ca' '131035c2816a154359af542ff002e53f48419311e6ab083eb9f944a5e2f0d24c') _get_project_dir() { local d@@ -40,12 +40,25 @@ nvm install "${_nodeversion}" nvm use "${_nodeversion}" }-_set_build_env() {- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"- export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"- export ELECTRON_SKIP_BINARY_DOWNLOAD=1- export ELECTRON_BUILDER_OFFLINE=true- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"+_set_go_build_env() {+ export HOME="${srcdir}/.home"+ export GOPATH="${HOME}/go"+ export GOCACHE="${HOME}/go-build"+ export GOENV="${HOME}/go/env"+ export XDG_CONFIG_HOME="${HOME}/.config"+ export XDG_CACHE_HOME="${HOME}/.cache"+ export CGO_CPPFLAGS="${CPPFLAGS}"+ export CGO_CFLAGS="${CFLAGS}"+ export CGO_CXXFLAGS="${CXXFLAGS}"+ export CGO_LDFLAGS="${LDFLAGS}"+ export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"+ export GOTOOLCHAIN=local+ export GOWORK=off+ mkdir -p "${HOME}" "${GOCACHE}" "${XDG_CONFIG_HOME}" "${XDG_CACHE_HOME}" "$(dirname "${GOENV}")"+ : > "${GOENV}"+ export PATH="${GOPATH}/bin:${PATH}"+}+_set_pnpm_build_env() { export HOME="${srcdir}/.home" export XDG_CACHE_HOME="${HOME}/.cache" export XDG_CONFIG_HOME="${HOME}/.config"@@ -75,21 +88,6 @@ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \ --registry "${COREPACK_NPM_REGISTRY}" fi- export GOPATH="${HOME}/go"- export GOCACHE="${HOME}/go-build"- export GOENV="${HOME}/go/env"- export XDG_CONFIG_HOME="${HOME}/.config"- export XDG_CACHE_HOME="${HOME}/.cache"- export CGO_CPPFLAGS="${CPPFLAGS}"- export CGO_CFLAGS="${CFLAGS}"- export CGO_CXXFLAGS="${CXXFLAGS}"- export CGO_LDFLAGS="${LDFLAGS}"- export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"- export GOTOOLCHAIN=local- export GOWORK=off- export PATH="${PATH}:$(go env GOPATH)/bin"- mkdir -p "${HOME}" "${GOCACHE}" "${XDG_CONFIG_HOME}" "${XDG_CACHE_HOME}" "$(dirname "${GOENV}")"- : > "${GOENV}" } prepare() { cd "$(_get_project_dir)"@@ -100,7 +98,8 @@ --name="${_pkgname}" \ --exec="${pkgname} %U" _ensure_local_nvm- _set_build_env+ _set_pnpm_build_env+ _set_go_build_env cp "${srcdir}/modifiers_linux.go" internal/hotkey/modifiers_linux.go go install github.com/wailsapp/wails/v3/cmd/wails3@latest cd "$(_get_project_dir)/frontend"@@ -108,9 +107,10 @@ pnpm install } build() {- _set_build_env+ cd "$(_get_project_dir)/build" _ensure_local_nvm- cd "$(_get_project_dir)/build"+ _set_pnpm_build_env+ _set_go_build_env go mod tidy wails3 generate bindings -f '-tags production -trimpath -buildvcs=false -ldflags="-w -s -X main.version=v4.0.1"' -clean=true -ts cd "$(_get_project_dir)/frontend"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 07:55:24 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 01:43:34 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |