ghost-chat

LOW

maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs 'wails3' via 'go install' from a public module, which is a common build step for Go-based projects and not inherently malicious, though it reduces supply-chain control.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs 'wails3' via 'go install' from a public module, which is a common build step for Go-based projects and not inherently malicious, though it reduces supply-chain control.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:76 go install github.com/wailsapp/wails/v3/cmd/wails3@latest

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=ghost-chat
    
      3_pkgname=GhostChat
    
      4pkgver=4.6.0
    
      5_nodeversion=24
    
      6pkgrel=1
    
      7pkgdesc="A Standalone chat overlay for Twitch, Kick, YouTube and other streaming platforms."
    
      8arch=('any')
    
      9url="https://github.com/Enubia/ghost-chat"
    
      10license=('LicenseRef-DBAD')
    
      11conflicts=("${pkgname}")
    
      12depends=(
    
  'webkitgtk-6.0'
    
  'gtk3'
    
      15)
    
      16makedepends=(
    
  'pnpm'
    
  'npm'
    
  'gendesk'
    
  'go'
    
  'nvm'
    
  'curl'
    
  'git'
    
      24)
    
      25source=(
    
  "${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}"
    
  "modifiers_linux.go"
    
      28)
    
      29sha256sums=('6ed8a00c74cbcee1f5ee5fb814acd376cafdbd2b980afca1a978d1d18e8a9e50'
    
          '131035c2816a154359af542ff002e53f48419311e6ab083eb9f944a5e2f0d24c')
    
      31_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      36}
    
      37_set_build_env() {
    
  export HOME="${srcdir}/.electron-gyp"
    
  export PATH="${HOME}/go/bin:$PATH"
    
  export CGO_ENABLED=1
    
  export GO111MODULE=on
    
  export GOOS=linux
    
  export GOCACHE="${srcdir}/go-build"
    
  export GOMODCACHE="${srcdir}/go/pkg/mod"
    
  {
    
      export PNPM_LINK_WORKSPACE_PACKAGES=true
    
      export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
    
      export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
    
      export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
    
      export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
    
      export PNPM_SHAMEFULLY_HOIST=true
    
      export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
    
      export PNPM_NODE_LINKER=hoisted
    
      export PNPM_NETWORK_CONCURRENCY=32
    
  }
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      {
    
          export pnpm_config_registry="https://registry.npmmirror.com"
    
          export npm_config_registry="https://registry.npmmirror.com"
    
          export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
    
          export GOPROXY=https://goproxy.cn,direct
    
      }
    
  fi
    
      64}
    
      65prepare() {
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  gendesk -f -n -q \
    
      --pkgname="${pkgname}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="Utility" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname} %U"
    
  _set_build_env
    
  _ensure_local_nvm
    
  cp "${srcdir}/modifiers_linux.go" internal/hotkey/modifiers_linux.go
    
  go install github.com/wailsapp/wails/v3/cmd/wails3@latest
    
  cd "${srcdir}/${pkgname}-${pkgver}/frontend"
    
  NODE_ENV=development    pnpm install --frozen-lockfile
    
      79}
    
      80build() {
    
  _set_build_env
    
  _ensure_local_nvm
    
  cd "${srcdir}/${pkgname}-${pkgver}/build"
    
  go mod tidy
    
  wails3 generate bindings -f '-tags production -trimpath -buildvcs=false -ldflags="-w -s -X main.version=v4.0.1"' -clean=true -ts
    
  cd "${srcdir}/${pkgname}-${pkgver}/frontend"
    
  NODE_ENV=production     pnpm run build
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  go build -tags production -trimpath -buildvcs=false -ldflags="-w -s -X main.version=v4.0.1" -o bin/ghost-chat
    
      90}
    
      91package() {
    
  install -Dm755 "${srcdir}/${pkgname}-${pkgver}/bin/${pkgname}" -t "${pkgdir}/usr/bin"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/build/appicon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE.md" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      96}
    
      97

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2