heroic-games-launcher-bun

LOW

maintainer School 0 votes scanned 2026-10-27 00:23:28.674093

View on AUR

Why flagged

Builds from the official Heroic Games Launcher GitHub repo; the flagged 'bun install' installs dependencies declared in the project's own lockfile (--frozen-lockfile), not an undeclared external package, and --ignore-scripts reduces risk; the only real concern is the low-vote/new status and a minor checksum discrepancy in the sha256sums length, but no malicious behaviour is evident.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Builds from the official Heroic Games Launcher GitHub repo; the flagged 'bun install' installs dependencies declared in the project's own lockfile (--frozen-lockfile), not an undeclared external package, and --ignore-scripts reduces risk; the only real concern is the low-vote/new status and a minor checksum discrepancy in the sha256sums length, but no malicious behaviour is evident.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium bun install of an undeclared external package bun_install_external

`bun add` / `bun install <package>` fetches an external package outside source=(). Severity downgraded: the package declares/looks like a Node.js consumer.

PKGBUILD:66 bun install --frozen-lockfile --ignore-scripts --linker hoisted

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sierra S. <sscoolqaz@protonmail.com>
    
      2# Contributor: Fabio 'Lolix' Loli <fabio.loli@disroot.org>
    
      3
    
      4pkgname=heroic-games-launcher-bun
    
      5pkgver=2.22.4
    
      6pkgrel=1
    
      7pkgdesc="Native GOG, Epic Games and Amazon games launcher for Linux (built with Bun)"
    
      8arch=(x86_64)
    
      9url="https://heroicgameslauncher.com/"
    
      10license=(GPL-3.0-only)
    
      11_electron=electron43
    
      12depends=(
    
      13    $_electron
    
      14    glibc
    
      15    hicolor-icon-theme
    
      16    libgcc
    
      17    python
    
      18    sh
    
      19    which
    
      20    zlib
    
      21    )
    
      22makedepends=(
    
      23    desktop-file-utils
    
      24    git
    
      25    nodejs
    
      26    bun
    
      27    )
    
      28provides=("heroic-games-launcher=$pkgver")
    
      29conflicts=(heroic-games-launcher heroic-games-launcher-bin heroic-games-launcher-git)
    
      30optdepends=(
    
      31    gamemode
    
      32    gamescope
    
      33    mangohud
    
      34    "rsync: Move games using rsync instead of mv"
    
      35    )
    
      36source=(
    
      37    "git+https://github.com/Heroic-Games-Launcher/HeroicGamesLauncher.git#tag=v${pkgver}"
    
      38    heroic.sh
    
      39    )
    
      40sha256sums=('a628cc8fb1bf533c7a437f32c7d21bf55dc990ac247c304a33e259870fa12a49'
    
      41            '6103e2429c60868452ad45e3537631a26812eeb3e3f57b5ba59c2f6f2b7398d9')
    
      42
    
      43prepare() {
    
      44  sed -i "s|@ELECTRON@|${_electron}|" heroic.sh
    
      45
    
      46  cd HeroicGamesLauncher
    
      47  bun -e '
    
      48    const fs = require("node:fs");
    
      49    const p = JSON.parse(fs.readFileSync("package.json", "utf8"));
    
      50    p.packageManager = `bun@${Bun.version}`;
    
      51    for (const key of Object.keys(p.scripts)) {
    
      52      p.scripts[key] = p.scripts[key].replaceAll("pnpm run ", "bun run ").replaceAll("pnpm ", "bun run ");
    
      53    }
    
      54    p.overrides = { ...p.overrides, "ts-morph": "17.0.1" };
    
      55    p.patchedDependencies = { "@types/node@22.19.3": "patches/@types__node@22.19.3.patch" };
    
      56    fs.writeFileSync("package.json", JSON.stringify(p, null, 2) + "\n");
    
      57    // pnpm 12 prefixes the application lock with a package-manager document.
    
      58    const lock = fs.readFileSync("pnpm-lock.yaml", "utf8").split(/^---\s*$/m).filter(s => s.trim());
    
      59    fs.writeFileSync("pnpm-lock.yaml", lock.at(-1).trimStart());
    
      60  '
    
      61  bun pm migrate
    
      62}
    
      63
    
      64build() {
    
      65  cd HeroicGamesLauncher
    
      66  bun install --frozen-lockfile --ignore-scripts --linker hoisted
    
      67  bun run download-helper-binaries
    
      68  bun run dist:linux --dir --x64 -c.electronDist=/usr/lib/$_electron/ -c.electronVersion=$(cat /usr/lib/$_electron/version)
    
      69}
    
      70
    
      71package() {
    
      72  install -Dm755 heroic.sh "${pkgdir}/usr/bin/heroic"
    
      73
    
      74  cd "HeroicGamesLauncher"
    
      75  install -d "${pkgdir}/usr/lib/heroic"
    
      76  cp -r dist/linux-unpacked/resources/app.asar{,.unpacked} "${pkgdir}/usr/lib/heroic/"
    
      77
    
      78  install -Dm644 flatpak/com.heroicgameslauncher.hgl.png -t "${pkgdir}/usr/share/icons/hicolor/128x128/apps"
    
      79  install -Dm644 src/frontend/assets/heroic-icon.svg "${pkgdir}/usr/share/icons/hicolor/scalable/com.heroicgameslauncher.hgl.svg"
    
      80
    
      81  # template and outdated
    
      82  #install -Dm644 flatpak/templates/com.heroicgameslauncher.hgl.metainfo.xml.template "${pkgdir}"/usr/share/metainfo/com.heroicgameslauncher.hgl.metainfo.xml
    
      83
    
      84  # fix icon on Gnome dock
    
      85  desktop-file-edit --set-key=Exec --set-value="heroic %U" flatpak/com.heroicgameslauncher.hgl.desktop
    
      86  install -Dm644 flatpak/com.heroicgameslauncher.hgl.desktop -t "${pkgdir}/usr/share/applications"
    
      87}
    
      88

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 00:23:28	Low	3
2026-10-26 23:48:31	Low	3
2026-10-26 23:46:04	Medium	2