hihat

LOW
maintainer zxp19821005 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The npx execution is part of the project's normal build process, using trusted sources and building from the project's own source code, which is downloaded from the official GitHub repository.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx execution is part of the project's normal build process, using trusted sources and building from the project's own source code, which is downloaded from the official GitHub repository.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:94 npx ts-node ./.erb/scripts/clean.js dist

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=hihat
3pkgver=2.4.0
4_electronversion=42
5_nodeversion=24
6pkgrel=1
7pkgdesc="A minimalist offline music library player for desktop, built on Electron, React, and Material UI.Use system-wide electron."
8arch=('any')
9url="https://github.com/johnnyshankman/hihat"
10license=('MIT')
11depends=(
12 "electron${_electronversion}"
13)
14makedepends=(
15 'gendesk'
16 'git'
17 'nvm'
18 'npm'
19 'jq'
20)
21_set_build_env() {
22 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
23 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
24 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
25 export ELECTRON_BUILDER_OFFLINE=true
26 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
27 export HOME="${srcdir}/.home"
28 export XDG_CACHE_HOME="${HOME}/.cache"
29 export XDG_CONFIG_HOME="${HOME}/.config"
30 export XDG_DATA_HOME="${HOME}/.local/share"
31 export npm_config_cache="${HOME}/.npm_cache"
32 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
33 export COREPACK_HOME="${HOME}/.corepack"
34 export npm_config_audit=false
35 export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
36 mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
37}
38source=(
39 "${pkgname}-${pkgver}::${url}/archive/refs/tags/${pkgver}.tar.gz"
40 "${pkgname}.js"
41 "${pkgname}.sh"
42)
43sha256sums=('1844f8690b17ea53c004225cf61cd4d31c46f187084861422ce1c8771774a112'
44 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
45 '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
46_get_project_dir() {
47 local d
48 while IFS= read -r d; do
49 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
50 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
51}
52_ensure_local_nvm() {
53 local NVM_DIR="${srcdir}/.nvm"
54 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
55 nvm install "${_nodeversion}"
56 nvm use "${_nodeversion}"
57}
58_get_app_dir() {
59 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
60 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
61}
62_get_electron_version() {
63 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
64 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
65 | grep -oE '[0-9]+' | head -1)
66 [[ -z "${_elec_ver}" ]] && return 1
67 (( _elec_ver == _electronversion )) && c=32 || c=31
68 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
69}
70prepare() {
71 cd "$(_get_project_dir)"
72 _get_electron_version
73 sed -i -e "
74 s/@electronversion@/${_electronversion}/g
75 s/@appname@/${pkgname}/g
76 " "${srcdir}/${pkgname}.sh" "${srcdir}/${pkgname}.js"
77 gendesk -q -f -n \
78 --pkgname="${pkgname}" \
79 --pkgdesc="${pkgdesc}" \
80 --categories="AudioVideo" \
81 --name="${pkgname}" \
82 --exec="${pkgname} %U"
83 _ensure_local_nvm
84 _set_build_env
85 jq '.bundle.active = false' src-tauri/tauri.conf.json > tmp.json && mv tmp.json src-tauri/tauri.conf.json
86 export NODE_ENV=development
87 npm install
88}
89build() {
90 cd "$(_get_project_dir)"
91 _ensure_local_nvm
92 _set_build_env
93 export NODE_ENV=production
94 npx ts-node ./.erb/scripts/clean.js dist
95 npm run build
96 npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
97 rm -rf "$(_get_app_dir)/resources/default_app.asar"
98}
99package() {
100 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
101 install -Dm644 "${srcdir}/${pkgname}.js" -t "${pkgdir}/usr/lib/${pkgname}"
102 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
103 install -Dm644 "$(_get_project_dir)/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
104 install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
105 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
106}
107

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,6 +1,6 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=hihat
-pkgver=2.3.6
+pkgver=2.4.0
_electronversion=42
_nodeversion=24
pkgrel=1
@@ -16,87 +16,92 @@
'git'
'nvm'
'npm'
- 'curl'
'jq'
)
-source=("${pkgname}.sh")
-sha256sums=('a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+_set_build_env() {
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export npm_config_cache="${HOME}/.npm_cache"
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ export npm_config_audit=false
+ export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
+ mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
+}
+source=(
+ "${pkgname}-${pkgver}::${url}/archive/refs/tags/${pkgver}.tar.gz"
+ "${pkgname}.js"
+ "${pkgname}.sh"
+)
+sha256sums=('1844f8690b17ea53c004225cf61cd4d31c46f187084861422ce1c8771774a112'
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
-}
-_set_build_env() {
- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- export HOME="${srcdir}/.electron-gyp"
- export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
- export NPM_CONFIG_MAXSOCKETS=32
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
- export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
- }
- find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
- fi
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
prepare() {
- cd "${srcdir}"
- if [[ ! -d "${srcdir}/${pkgname}-${pkgver}" ]]; then
- git clone \
- --depth 1 \
- --branch "${pkgver}" \
- "${url}" \
- "${pkgname}-${pkgver}"
- fi
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${pkgname}/g
- " "${srcdir}/${pkgname}.sh"
+ " "${srcdir}/${pkgname}.sh" "${srcdir}/${pkgname}.js"
gendesk -q -f -n \
--pkgname="${pkgname}" \
--pkgdesc="${pkgdesc}" \
--categories="AudioVideo" \
--name="${pkgname}" \
--exec="${pkgname} %U"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- find src -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development npm install --legacy-peer-deps
+ jq '.bundle.active = false' src-tauri/tauri.conf.json > tmp.json && mv tmp.json src-tauri/tauri.conf.json
+ export NODE_ENV=development
+ npm install
}
build() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- NODE_ENV=production npx ts-node ./.erb/scripts/clean.js dist
- NODE_ENV=production npm run build
- NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
+ export NODE_ENV=production
+ npx ts-node ./.erb/scripts/clean.js dist
+ npm run build
+ npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
- install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname}/"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${srcdir}/${pkgname}.js" -t "${pkgdir}/usr/lib/${pkgname}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
+ install -Dm644 "$(_get_project_dir)/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
+ install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 07:52:02 Medium 1
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 00:06:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion