hawkpass-git

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD runs 'npm install' and 'npm add -D @electron-forge/plugin-local-electron' during prepare(). Both operations pull from the npm registry (or npmmirror.com for CN users), which is the standard, official Node.js package ecosystem. The source is a legitimate GitHub repository (kalpetros/hawkpass), and the npm packages being installed are declared dependencies of the project plus a well-known electron-forge plugin. This is standard practice for building Electron apps in AUR packages. The npm registry is not an 'unofficial or personal host' — it is the canonical package registry for Node.js. The CN mirror fallback (npmmirror.com) is a well-known official mirror. There is no execution of pre-built binaries from unofficial hosts, no obfuscation, and no exfiltration. The pattern of using nvm to manage Node.js versions and running npm install during build is common in AUR Electron packages. The supply-chain risk is the same as any npm-based build and does not elevate above the baseline for such packages. Rating as low rather than clean only because the dynamic npm install during build means package contents are not fully pinned by the PKGBUILD's checksums (no package-lock.json integrity enforcement), which is a minor concern but not a medium-severity supply-chain issue.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The PKGBUILD runs 'npm install' and 'npm add -D @electron-forge/plugin-local-electron' during prepare(). Both operations pull from the npm registry (or npmmirror.com for CN users), which is the standard, official Node.js package ecosystem. The source is a legitimate GitHub repository (kalpetros/hawkpass), and the npm packages being installed are declared dependencies of the project plus a well-known electron-forge plugin. This is standard practice for building Electron apps in AUR packages. The npm registry is not an 'unofficial or personal host' — it is the canonical package registry for Node.js. The CN mirror fallback (npmmirror.com) is a well-known official mirror. There is no execution of pre-built binaries from unofficial hosts, no obfuscation, and no exfiltration. The pattern of using nvm to manage Node.js versions and running npm install during build is common in AUR Electron packages. The supply-chain risk is the same as any npm-based build and does not elevate above the baseline for such packages. Rating as low rather than clean only because the dynamic npm install during build means package contents are not fully pinned by the PKGBUILD's checksums (no package-lock.json integrity enforcement), which is a minor concern but not a medium-severity supply-chain issue.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:82 NODE_ENV=development npm add -D @electron-forge/plugin-local-electron

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=hawkpass-git
    
      3_pkgname=Hawkpass
    
      4pkgver=1.2.0.r19.g632adad
    
      5_electronversion=22
    
      6_nodeversion=18
    
      7pkgrel=1
    
      8pkgdesc="Secure diceware passphrase generator.(Use system-wide electron)"
    
      9arch=('any')
    
      10url="https://kalpetros.github.io/hawkpass"
    
      11_ghurl="https://github.com/kalpetros/hawkpass"
    
      12license=('MIT')
    
      13conflicts=("${pkgname%-git}")
    
      14provides=("${pkgname%-git}=${pkgver%.r*}")
    
      15depends=(
    
      16    "electron${_electronversion}"
    
      17    'nodejs'
    
      18)
    
      19makedepends=(
    
      20    'npm'
    
      21    'git'
    
      22    'gendesk'
    
      23    'curl'
    
      24    'nvm'
    
      25)
    
      26options=(
    
      27    '!strip'
    
      28    '!emptydirs'
    
      29)
    
      30source=(
    
      31    "${pkgname//-/.}::git+${_ghurl}.git"
    
      32    "${pkgname%-git}.sh"
    
      33)
    
      34sha256sums=('SKIP'
    
      35            '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
    
      36pkgver() {
    
      37    cd "${srcdir}/${pkgname//-/.}"
    
      38    set -o pipefail
    
      39    git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
      40    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      41}
    
      42_ensure_local_nvm() {
    
      43    local NVM_DIR="${srcdir}/.nvm"
    
      44    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      45    nvm install "${_nodeversion}"
    
      46    nvm use "${_nodeversion}"
    
      47}
    
      48prepare() {
    
      49    cd "${srcdir}/${pkgname//-/.}"
    
      50    sed -i -e "
    
      51        s/@electronversion@/${_electronversion}/g
    
      52        s/@appname@/${pkgname%-git}/g
    
      53        s/@runname@/app.asar/g
    
      54        s/@cfgdirname@/${pkgname%-git}/g
    
      55        s/@options@//g
    
      56    " "${srcdir}/${pkgname%-git}.sh"
    
      57    _ensure_local_nvm
    
      58    gendesk -q -f -n \
    
      59        --pkgname="${pkgname%-git}" \
    
      60        --pkgdesc="${pkgdesc}" \
    
      61        --categories="Utility" \
    
      62        --name="${_pkgname}" \
    
      63        --exec="${pkgname%-git} %U"
    
      64    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      65    export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
      66    HOME="${srcdir}/.electron-gyp"
    
      67    {
    
      68        echo -e '\n'
    
      69        #echo 'build_from_source=true'
    
      70        echo "cache=${srcdir}/.npm_cache"
    
      71    } >> .npmrc
    
      72    if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      73        {
    
      74            echo 'registry=https://registry.npmmirror.com'
    
      75            echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
    
      76            echo 'electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/'
    
      77        } >> .npmrc
    
      78        find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
    
      79    fi
    
      80    sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
      81    NODE_ENV=development    npm install
    
      82    NODE_ENV=development    npm add -D @electron-forge/plugin-local-electron
    
      83}
    
      84build() {
    
      85    cd "${srcdir}/${pkgname//-/.}"
    
      86    local electronDist="/usr/lib/electron${_electronversion}"
    
      87    sed -i '/"makers": \[/i\
    
      88	"plugins": [\
    
      89		{\
    
      90			"name": "@electron-forge/plugin-local-electron",\
    
      91			"config": {\
    
      92				"electronPath": "'"${electronDist}"'"\
    
      93			}\
    
      94		}\
    
      95	],' package.json
    
      96    NODE_ENV=production     npm run build
    
      97    NODE_ENV=production     npm run package
    
      98    rm -rf out/"${pkgname%-git}"-linux-*/resources/app/.cache
    
      99}
    
      100package() {
    
      101    install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
      102    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
    
      103    cp -Pr --no-preserve=ownership "${srcdir}/${pkgname//-/.}/out/${pkgname%-git}-linux-"*/resources/app "${pkgdir}/usr/lib/${pkgname%-git}"
    
      104    install -Dm644 "${srcdir}/${pkgname//-/.}/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
    
      105    install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
      106    install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      107}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2