gnome-shell-extension-mosaic

LOW

maintainer yochananmarqos 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The flagged pattern is `npm install typescript@5.7.3` in the prepare() step. This installs a specific pinned version of TypeScript from the npm registry as a build-time dependency (used for compilation via `make compile`). This is a common and legitimate pattern in AUR packages that build TypeScript-based GNOME extensions. The package source is fetched from the official GitHub repository via a tagged release tarball with a declared sha256sum. The npm_config_cache is redirected to srcdir to avoid polluting the system. TypeScript is a well-known, widely-used Microsoft-maintained package. The nvm usage is also a recognized AUR pattern for managing Node.js versions in a sandboxed way. No obfuscation, no remote code execution, no exfiltration, no attacker-controlled hosts. The only concern is that npm install fetches from the network without a lockfile checksum verification, which is a minor supply-chain hygiene issue but not malicious.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The flagged pattern is `npm install typescript@5.7.3` in the prepare() step. This installs a specific pinned version of TypeScript from the npm registry as a build-time dependency (used for compilation via `make compile`). This is a common and legitimate pattern in AUR packages that build TypeScript-based GNOME extensions. The package source is fetched from the official GitHub repository via a tagged release tarball with a declared sha256sum. The npm_config_cache is redirected to srcdir to avoid polluting the system. TypeScript is a well-known, widely-used Microsoft-maintained package. The nvm usage is also a recognized AUR pattern for managing Node.js versions in a sandboxed way. No obfuscation, no remote code execution, no exfiltration, no attacker-controlled hosts. The only concern is that npm install fetches from the network without a lockfile checksum verification, which is a minor supply-chain hygiene issue but not malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

High npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time.

PKGBUILD:51 npm install typescript@5.7.3

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
    
      2pkgname=gnome-shell-extension-mosaic
    
      3_app_id=com.github.jardon.gnome-mosaic
    
      4pkgver=1.7.0
    
      5pkgrel=1
    
      6_nodeversion=20
    
      7pkgdesc="GNOME window tiling extension"
    
      8arch=('any')
    
      9url="https://github.com/jardon/gnome-mosaic"
    
      10license=('GPL-3.0-or-later')
    
      11depends=(
    
      12  'gnome-shell'
    
      13  'xorg-xprop'
    
      14)
    
      15makedepends=(
    
      16  'jq'
    
      17  'nvm'
    
      18)
    
      19checkdepends=('desktop-file-utils')
    
      20optdepends=('gnome-shell-extensions: for Native Window Placment extension')
    
      21source=("gnome-mosaic-$pkgver.tar.gz::$url/archive/refs/tags/$pkgver.tar.gz"
    
      22        '50_org.gnome.desktop.wm.keybindings.gnome-mosiac.gschema.override'
    
      23        '50_org.gnome.mutter.keybindings.gnome-mosaic.gschema.override'
    
      24        '50_org.gnome.mutter.wayland.keybindings.gnome-mosaic.gschema.override'
    
      25        '50_org.gnome.settings-daemon.plugins.media-keys.gnome-mosaic.gschema.override'
    
      26        '50_org.gnome.shell.keybindings.gnome-mosaic.gschema.override')
    
      27sha256sums=('4479469a413e2d91eb0d9bce4d69e678dc822651074033ab6ee233fba2b55bb6'
    
      28            '484bf48f12d2fa503c27ed34f6d190edb94ec844a0b49c6ff1bda872081e6b64'
    
      29            'f98115fbf502394ffb2eb2a38452a743ab087eadef7e009c62e93ee15c9f3849'
    
      30            'd3a4ac86303c9065fd76dace64283573079c3bdce4b9a2ca18be5f103eb6fd4c'
    
      31            'a6ed6eed9fba7ab0668caa5cb93f56152cd90e1047b4bdfd76dc5b5f8862b6fd'
    
      32            '7ebe94923b20c2bfc2382945ad635620f1b460c06e01694bb57074625414547e')
    
      33
    
      34_ensure_local_nvm() {
    
      35  # let's be sure we are starting clean
    
      36  which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      37  export NVM_DIR="${srcdir}/.nvm"
    
      38
    
      39  # The init script returns 3 if version specified
    
      40  # in ./.nvmrc is not (yet) installed in $NVM_DIR
    
      41  # but nvm itself still gets loaded ok
    
      42  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      43}
    
      44
    
      45prepare() {
    
      46  cd "gnome-mosaic-$pkgver"
    
      47  _ensure_local_nvm
    
      48  nvm install "${_nodeversion}"
    
      49
    
      50  export npm_config_cache="$srcdir/npm_cache"
    
      51  npm install typescript@5.7.3
    
      52
    
      53  # Extension path
    
      54  sed -i 's|~/.local|/usr|g' "${_app_id}-exceptions.desktop"
    
      55}
    
      56
    
      57build() {
    
      58  cd "gnome-mosaic-$pkgver"
    
      59  export npm_config_cache="$srcdir/npm_cache"
    
      60  export PATH="node_modules/.bin:${PATH}"
    
      61  _ensure_local_nvm
    
      62  make compile
    
      63  make translations
    
      64}
    
      65
    
      66check() {
    
      67  cd "gnome-mosaic-$pkgver"
    
      68  desktop-file-validate "${_app_id}-exceptions.desktop"
    
      69}
    
      70
    
      71package() {
    
      72  cd "gnome-mosaic-$pkgver"
    
      73  _uuid=$(jq -r .uuid metadata.json)
    
      74
    
      75  install -d "$pkgdir/usr/share/gnome-shell/extensions/${_uuid}"
    
      76  cp -rv _build/* "$pkgdir/usr/share/gnome-shell/extensions/${_uuid}/"
    
      77
    
      78   mv -v "$pkgdir/usr/share/gnome-shell/extensions/${_uuid}/locale" "$pkgdir/usr/share"
    
      79
    
      80  install -Dvm644 schemas/*.xml -t "$pkgdir/usr/share/glib-2.0/schemas/"
    
      81  rm -rfv "$pkgdir/usr/share/gnome-shell/extensions/${_uuid}/schemas"
    
      82
    
      83  install -Dvm644 "${_app_id}-exceptions.desktop" -t \
    
      84    "$pkgdir/usr/share/applications/"
    
      85  install -Dvm644 icons/mosaic-logo.svg \
    
      86    "$pkgdir/usr/share/icons/hicolor/scalable/apps/${_app_id}-exceptions.svg"
    
      87  install -Dvm644 keybindings/*.xml -t "$pkgdir/usr/share/gnome-control-center/keybindings/"
    
      88  install -Dvm644 SHORTCUTS.md -t "$pkgdir/usr/share/doc/$pkgname/"
    
      89
    
      90  install -Dvm644 "$srcdir"/*.gnome-mosaic.gschema.override -t \
    
      91    "$pkgdir/usr/share/glib-2.0/schemas/"
    
      92}
    
      93

Changes since previous scan

--- PKGBUILD @ 2026-09-13 00:19
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,6 +1,7 @@
 # Maintainer: Mark Wagie <mark dot wagie at proton dot me>
 pkgname=gnome-shell-extension-mosaic
-pkgver=1.6.5
+_app_id=com.github.jardon.gnome-mosaic
+pkgver=1.7.0
 pkgrel=1
 _nodeversion=20
 pkgdesc="GNOME window tiling extension"
@@ -15,6 +16,7 @@
   'jq'
   'nvm'
 )
+checkdepends=('desktop-file-utils')
 optdepends=('gnome-shell-extensions: for Native Window Placment extension')
 source=("gnome-mosaic-$pkgver.tar.gz::$url/archive/refs/tags/$pkgver.tar.gz"
         '50_org.gnome.desktop.wm.keybindings.gnome-mosiac.gschema.override'
@@ -22,7 +24,7 @@
         '50_org.gnome.mutter.wayland.keybindings.gnome-mosaic.gschema.override'
         '50_org.gnome.settings-daemon.plugins.media-keys.gnome-mosaic.gschema.override'
         '50_org.gnome.shell.keybindings.gnome-mosaic.gschema.override')
-sha256sums=('fffcfebd6d18abf0dae639e337cac65975d1ec076e47d4ec774619c30407e3bd'
+sha256sums=('4479469a413e2d91eb0d9bce4d69e678dc822651074033ab6ee233fba2b55bb6'
             '484bf48f12d2fa503c27ed34f6d190edb94ec844a0b49c6ff1bda872081e6b64'
             'f98115fbf502394ffb2eb2a38452a743ab087eadef7e009c62e93ee15c9f3849'
             'd3a4ac86303c9065fd76dace64283573079c3bdce4b9a2ca18be5f103eb6fd4c'
@@ -47,6 +49,9 @@
 
   export npm_config_cache="$srcdir/npm_cache"
   npm install typescript@5.7.3
+
+  # Extension path
+  sed -i 's|~/.local|/usr|g' "${_app_id}-exceptions.desktop"
 }
 
 build() {
@@ -55,6 +60,12 @@
   export PATH="node_modules/.bin:${PATH}"
   _ensure_local_nvm
   make compile
+  make translations
+}
+
+check() {
+  cd "gnome-mosaic-$pkgver"
+  desktop-file-validate "${_app_id}-exceptions.desktop"
 }
 
 package() {
@@ -64,9 +75,16 @@
   install -d "$pkgdir/usr/share/gnome-shell/extensions/${_uuid}"
   cp -rv _build/* "$pkgdir/usr/share/gnome-shell/extensions/${_uuid}/"
 
+   mv -v "$pkgdir/usr/share/gnome-shell/extensions/${_uuid}/locale" "$pkgdir/usr/share"
+
   install -Dvm644 schemas/*.xml -t "$pkgdir/usr/share/glib-2.0/schemas/"
   rm -rfv "$pkgdir/usr/share/gnome-shell/extensions/${_uuid}/schemas"
 
+  install -Dvm644 "${_app_id}-exceptions.desktop" -t \
+    "$pkgdir/usr/share/applications/"
+  install -Dvm644 icons/mosaic-logo.svg \
+    "$pkgdir/usr/share/icons/hicolor/scalable/apps/${_app_id}-exceptions.svg"
+  install -Dvm644 keybindings/*.xml -t "$pkgdir/usr/share/gnome-control-center/keybindings/"
   install -Dvm644 SHORTCUTS.md -t "$pkgdir/usr/share/doc/$pkgname/"
 
   install -Dvm644 "$srcdir"/*.gnome-mosaic.gschema.override -t \

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 15:17:35	High	1
2026-09-14 00:27:57	Low	2
2026-09-13 17:17:16	Low	2
2026-09-13 17:14:56	High	1
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2