gitify

LOW
maintainer zxp19821005 1 votes scanned 2026-10-07 14:05:47.471701
View on AUR
Why flagged

The package installs a version-pinned pnpm from npm via a variable derived from package.json, but this is part of normal build tooling setup using trusted sources and does not involve untrusted or obfuscated remote code execution.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs a version-pinned pnpm from npm via a variable derived from package.json, but this is part of normal build tooling setup using trusted sources and does not involve untrusted or obfuscated remote code execution.

  • PKGBUILD:79 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2# Contributor: PolpOnline <aur at t0mmy dot anonaddy dot com>
3pkgname=gitify
4_pkgname=Gitify
5pkgver=7.9.0
6_electronversion=44
7_nodeversion=24
8pkgrel=1
9pkgdesc="GitHub notifications on your menu bar."
10arch=('any')
11url='https://www.gitify.io/'
12_ghurl="https://github.com/gitify-app/gitify"
13license=('MIT')
14depends=(
15 "electron${_electronversion}"
16)
17makedepends=(
18 'gendesk'
19 'nvm'
20 'npm'
21 'pnpm'
22 'icoutils'
23 'git'
24 'jq'
25)
26source=(
27 "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
28 "${pkgname}.sh"
29)
30sha256sums=('71c65e9331945d7fc1245633c11b31a70c7e226b0742cbe307b422aad44fdfc0'
31 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
32_ensure_local_nvm() {
33 local NVM_DIR="${srcdir}/.nvm"
34 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
35 nvm install "${_nodeversion}"
36 nvm use "${_nodeversion}"
37}
38_get_project_dir() {
39 local d
40 while IFS= read -r d; do
41 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
42 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
43}
44_get_app_dir() {
45 find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
46}
47_set_build_env() {
48 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
49 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
50 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
51 export ELECTRON_BUILDER_OFFLINE=true
52 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
53 export HOME="${srcdir}/.home"
54 export XDG_CACHE_HOME="${HOME}/.cache"
55 export XDG_CONFIG_HOME="${HOME}/.config"
56 export XDG_DATA_HOME="${HOME}/.local/share"
57 export XDG_STATE_HOME="${HOME}/.local/state"
58 export PNPM_HOME="${HOME}/.pnpm/bin"
59 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
60 export pnpm_config_store_dir="${HOME}/.pnpm_store"
61 export pnpm_config_global_dir="${HOME}/.pnpm/global"
62 export pnpm_config_state_dir="${HOME}/.pnpm/state"
63 export pnpm_config_node_linker=hoisted
64 export pnpm_config_minimum_release_age=0
65 export pnpm_config_update_notifier=false
66 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
67 export COREPACK_HOME="${HOME}/.corepack"
68 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
69 export PATH="${PNPM_HOME}:${PATH}"
70 local _pnpmver=""
71 local _pkgjson="$(_get_project_dir)/package.json"
72 if [ -f "${_pkgjson}" ]; then
73 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
74 if [ -z "${_pnpmver}" ]; then
75 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
76 fi
77 fi
78 if [ -n "${_pnpmver}" ]; then
79 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
80 --registry "${COREPACK_NPM_REGISTRY}"
81 fi
82}
83_get_electron_version() {
84 local _pkg_dir="$(_get_project_dir)"
85 _elec_ver=$(find "${_pkg_dir}" -name "package.json" ! -path "*/node_modules/*" -print \
86 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
87 | grep -v '^$' | grep -v 'catalog:' | sed 's/^[^0-9]*//' | head -1)
88 if [[ -z "${_elec_ver}" ]]; then
89 # Try to get version from pnpm-workspace.yaml catalog
90 local _workspace_file="${_pkg_dir}/pnpm-workspace.yaml"
91 if [[ -f "${_workspace_file}" ]]; then
92 _elec_ver=$(grep -A1 '^catalog:' "${_workspace_file}" | grep 'electron:' | grep -oE '[0-9][0-9.]*' | head -1)
93 fi
94 fi
95 [[ -z "${_elec_ver}" ]] && return 1
96 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
97}
98prepare() {
99 cd "$(_get_project_dir)"
100 _get_electron_version
101 sed -i -e "
102 s/@electronversion@/${_electronversion}/g
103 s/@appname@/${pkgname}/g
104 s/@runname@/app.asar/g
105 s/@cfgdirname@/${pkgname}/g
106 " "${srcdir}/${pkgname}.sh"
107 gendesk -f -n -q \
108 --pkgname="${pkgname}" \
109 --pkgdesc="${pkgdesc}" \
110 --categories="Development" \
111 --name="${_pkgname}" \
112 --exec="${pkgname} --password-store=gnome-keyring %U"
113 _ensure_local_nvm
114 _set_build_env
115 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
116 rm -rf pnpm-lock.yaml
117 icotool -x assets/images/app-icon.ico -o assets/images/app-icon.png
118 export NODE_ENV=development
119 pnpm install
120}
121build() {
122 cd "$(_get_project_dir)"
123 _ensure_local_nvm
124 _set_build_env
125 export NODE_ENV=production
126 pnpm run build
127 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.js"
128}
129package() {
130 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
131 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
132 local _app_dir="$(_get_app_dir)"
133 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
134 rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
135 local _src="$(_get_project_dir)"
136 install -Dm644 "${_src}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
137 install -Dm644 "${_src}/assets/images/app-icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
138 install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
139}

Changes since previous scan

--- PKGBUILD @ 2026-09-07 09:14
+++ PKGBUILD @ 2026-10-07 14:05
@@ -2,7 +2,7 @@
# Contributor: PolpOnline <aur at t0mmy dot anonaddy dot com>
pkgname=gitify
_pkgname=Gitify
-pkgver=7.8.0
+pkgver=7.9.0
_electronversion=44
_nodeversion=24
pkgrel=1
@@ -20,59 +20,83 @@
'npm'
'pnpm'
'icoutils'
- 'curl'
'git'
'jq'
)
source=(
- "${pkgname}-${pkgver}::git+${_ghurl}#tag=v${pkgver}"
+ "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
"${pkgname}.sh"
)
-sha256sums=('2155a94e22ec3b896b2ee3945fdc39c07f077a215041803365e7abdc34b5f381'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+sha256sums=('71c65e9331945d7fc1245633c11b31a70c7e226b0742cbe307b422aad44fdfc0'
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
}
_set_build_env() {
- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- export HOME="${srcdir}/.electron-gyp"
- {
- export PNPM_LINK_WORKSPACE_PACKAGES=true
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_SHAMEFULLY_HOIST=true
- export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
- export PNPM_NODE_LINKER=hoisted
- export PNPM_NETWORK_CONCURRENCY=32
- }
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export pnpm_config_registry="https://registry.npmmirror.com"
- export npm_config_registry="https://registry.npmmirror.com"
- export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
- export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- }
- fi
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ local _pkg_dir="$(_get_project_dir)"
+ _elec_ver=$(find "${_pkg_dir}" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | grep -v 'catalog:' | sed 's/^[^0-9]*//' | head -1)
+ if [[ -z "${_elec_ver}" ]]; then
+ # Try to get version from pnpm-workspace.yaml catalog
+ local _workspace_file="${_pkg_dir}/pnpm-workspace.yaml"
+ if [[ -f "${_workspace_file}" ]]; then
+ _elec_ver=$(grep -A1 '^catalog:' "${_workspace_file}" | grep 'electron:' | grep -oE '[0-9][0-9.]*' | head -1)
+ fi
+ fi
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
@@ -86,27 +110,30 @@
--categories="Development" \
--name="${_pkgname}" \
--exec="${pkgname} --password-store=gnome-keyring %U"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ rm -rf pnpm-lock.yaml
icotool -x assets/images/app-icon.ico -o assets/images/app-icon.png
- NODE_ENV=development pnpm install
+ export NODE_ENV=development
+ pnpm install
}
build() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- NODE_ENV=production pnpm run build
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.js"
+ export NODE_ENV=production
+ pnpm run build
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.js"
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/dist/linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname}"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/assets/images/app-icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ local _app_dir="$(_get_app_dir)"
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
+ rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
+ local _src="$(_get_project_dir)"
+ install -Dm644 "${_src}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "${_src}/assets/images/app-icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
+ install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
-

Scan history

Scanned at (UTC)SeverityRules
2026-10-07 14:05:47 Low 1
2026-09-07 09:14:05 Clean 0
2026-08-31 01:44:31 Clean 0
2026-08-27 03:31:49 Clean 0
2026-08-24 11:22:50 Clean 0
2026-08-18 05:38:33 Clean 0
2026-08-13 01:25:20 Clean 0
2026-07-30 01:13:52 Clean 0
2026-07-28 01:36:52 Clean 0
2026-07-27 09:34:56 Clean 0
2026-07-22 01:18:42 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion