go-to-meeting-desktop

maintainer FurTabs · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs 'yarn' (fetching arbitrary npm dependencies at build time) and 'npx electron-builder --linux dir' which can also pull packages from the npm registry during the build. The sources use MD5 checksums of 'SKIP', meaning no integrity verification. The actual application is a nativefier wrapper around the GoToMeeting web app, which is a legitimate use case. The main concern is the unconstrained 'yarn' dependency fetch during build, which could pull in malicious or compromised npm packages, and the lack of any checksum verification. This is a supply-chain risk (unverified remote code execution via npm ecosystem) but not clearly malicious intent - it's a sloppy packaging practice common in early AUR electron packages. The npx call here is local (electron-builder is installed via yarn, not fetched remotely by npx at runtime), so the flagged pattern is somewhat mitigated. Overall this rates as medium risk due to the unchecked npm dependency fetching and missing checksums.

Triggered rules

MEDIUM AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it MEDIUM (confidence 72%): The PKGBUILD runs 'yarn' (fetching arbitrary npm dependencies at build time) and 'npx electron-builder --linux dir' which can also pull packages from the npm registry during the build. The sources use MD5 checksums of 'SKIP', meaning no integrity verification. The actual application is a nativefier wrapper around the GoToMeeting web app, which is a legitimate use case. The main concern is the unconstrained 'yarn' dependency fetch during build, which could pull in malicious or compromised npm packages, and the lack of any checksum verification. This is a supply-chain risk (unverified remote code execution via npm ecosystem) but not clearly malicious intent - it's a sloppy packaging practice common in early AUR electron packages. The npx call here is local (electron-builder is installed via yarn, not fetched remotely by npx at runtime), so the flagged pattern is somewhat mitigated. Overall this rates as medium risk due to the unchecked npm dependency fetching and missing checksums.

1 higher static finding superseded - not the current verdict (shown for transparency)

HIGH npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell.

PKGBUILD:17 npx electron-builder --linux dir

PKGBUILD

1 offending line(s) highlighted

      1#Maintainer: CrankySupertoon <crankysupertoon@gmail.com>
    
      2
    
      3pkgname=go-to-meeting-desktop
    
      4pkgver=1.0.0
    
      5pkgrel=1
    
      6pkgdesc="Go To Meeting desktop built with electron"
    
      7arch=("x86_64")
    
      8license=("custom")
    
      9makedepends=("electron" "gendesk")
    
      10source_x86_64=("https://raw.githubusercontent.com/CrankySupertoon/gotomeeting-nativefier/master/icon.png"
    
      11	       "https://github.com/CrankySupertoon/gotomeeting-linux-desktop/archive/${pkgver}.tar.gz")
    
      12md5sums_x86_64=('SKIP' 'SKIP')
    
      13
    
      14build() {
    
      15  cd "${srcdir}/gotomeeting-linux-desktop-${pkgver}"
    
      16  yarn
    
      17  npx electron-builder --linux dir
    
      18}
    
      19
    
      20prepare() {
    
      21    # Generate .desktop
    
      22    gendesk --pkgname "GoToMeeting" --pkgdesc "${pkgdesc}" --icon ${pkgname} --exec "/usr/bin/${pkgname}" -n -f
    
      23}
    
      24
    
      25package() {
    
      26    # install the main files.
    
      27    install -d -m755 "${pkgdir}/opt/${pkgname}"
    
      28    cp -Rr "${srcdir}/gotomeeting-linux-desktop-${pkgver}/dist/linux-unpacked/"* "${pkgdir}/opt/${pkgname}"
    
      29
    
      30    # desktop entry
    
      31    install -D -m644 "${srcdir}/GoToMeeting.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      32
    
      33    # install the icon
    
      34    install -d -m755 "${pkgdir}/usr/share/icons"
    
      35    cp -Rr "${srcdir}/icon.png" "${pkgdir}/usr/share/icons/${pkgname}.png"
    
      36
    
      37    # fix file permissions - all files as 644 - directories as 755
    
      38    find "${pkgdir}/"{opt,usr} -type d -exec chmod 755 {} \;
    
      39    find "${pkgdir}/"{opt,usr} -type f -exec chmod 644 {} \;
    
      40
    
      41    # make sure the main binary has the right permissions
    
      42    chmod +x "${pkgdir}/opt/${pkgname}/${pkgname}"
    
      43
    
      44    # link the binary
    
      45    install -d -m755 "${pkgdir}/usr/bin"
    
      46    ln -sr "${pkgdir}/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2