hugin-messenger

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged pattern involves pnpm installing dependencies during build, but this is part of building the project from its own source (git repo) and uses standard development tools; the dependencies are not externally declared malicious packages, and the build process runs in a controlled environment with no evidence of remote code execution or supply-chain compromise.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged pattern involves pnpm installing dependencies during build, but this is part of building the project from its own source (git repo) and uses standard development tools; the dependencies are not externally declared malicious packages, and the build process runs in a controlled environment with no evidence of remote code execution or supply-chain compromise.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:92 NODE_ENV=development pnpm add -D node-gyp

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2_appname=hugin
    
      3pkgname="${_appname}-messenger"
    
      4_pkgname='Hugin Messenger'
    
      5pkgver=2.0.0
    
      6_electronversion=30
    
      7_nodeversion=22
    
      8pkgrel=1
    
      9pkgdesc="A secure and private messaging desktop application.(Use system-wide electron)"
    
      10arch=('any')
    
      11url="https://hugin.chat/"
    
      12_ghurl="https://github.com/kryptokrona/hugin-desktop"
    
      13license=('GPL-3.0-only')
    
      14conflicts=("${pkgname}")
    
      15depends=(
    
      16    "electron${_electronversion}"
    
      17)
    
      18makedepends=(
    
      19    'npm'
    
      20    'nvm'
    
      21    'gendesk'
    
      22    'curl'
    
      23    'python-setuptools'
    
      24    'git'
    
      25    'jq'
    
      26)
    
      27source=(
    
      28    "${pkgname}-${pkgver}::git+${_ghurl}#tag=${pkgver}"
    
      29    "${pkgname}.sh"
    
      30)
    
      31sha256sums=('fc78ee41f80a9cc48efd000c283510e2a64c2596bbc1676c0d6996fbd3d544a5'
    
      32            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      33_ensure_local_nvm() {
    
      34    local NVM_DIR="${srcdir}/.nvm"
    
      35    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      36    nvm install "${_nodeversion}"
    
      37    nvm use "${_nodeversion}"
    
      38}
    
      39_get_app_dir() {
    
      40    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      41}
    
      42_set_build_env() {
    
      43    export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
    
      44    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      45    export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
      46    export HOME="${srcdir}/.electron-gyp"
    
      47    {
    
      48        export PNPM_LINK_WORKSPACE_PACKAGES=true
    
      49        export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
    
      50        export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
    
      51        export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
    
      52        export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
    
      53        export PNPM_SHAMEFULLY_HOIST=true
    
      54        export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
    
      55        export PNPM_NODE_LINKER=hoisted
    
      56        export PNPM_NETWORK_CONCURRENCY=32
    
      57    }
    
      58    if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      59        {
    
      60            export pnpm_config_registry="https://registry.npmmirror.com"
    
      61            export npm_config_registry="https://registry.npmmirror.com"
    
      62            export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
    
      63            export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
    
      64            export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
    
      65        }
    
      66    fi
    
      67}
    
      68_get_electron_version() {
    
      69    _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
    
      70        -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
    
      71    [[ -z "${_elec_ver}" ]] && return 1
    
      72    echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
    
      73}
    
      74prepare() {
    
      75    cd "${srcdir}/${pkgname}-${pkgver}"
    
      76    _get_electron_version
    
      77    sed -i -e "
    
      78        s/@electronversion@/${_electronversion}/g
    
      79        s/@appname@/${pkgname}/g
    
      80        s/@runname@/app.asar/g
    
      81        s/@cfgdirname@/${_pkgname}/g
    
      82    " "${srcdir}/${pkgname}.sh"
    
      83    gendesk -f -n -q \
    
      84        --pkgname="${pkgname}" \
    
      85        --pkgdesc="${pkgdesc}" \
    
      86        --categories="Network" \
    
      87        --name="${_pkgname}" \
    
      88        --exec="${pkgname} %U"
    
      89    _set_build_env
    
      90    _ensure_local_nvm
    
      91    sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
      92    NODE_ENV=development    pnpm add -D node-gyp
    
      93    NODE_ENV=development    pnpm install --frozen-lockfile
    
      94    # Fix C++ standard mismatch: usb module builds with c++14 but Electron 30's
    
      95    # V8 headers require c++17 (std::is_void_v, std::is_convertible_v, etc.)
    
      96    sed -i 's|-std=c++14|-std=c++17|g' node_modules/usb/binding.gyp
    
      97}
    
      98build() {
    
      99    cd "${srcdir}/${pkgname}-${pkgver}"
    
      100    _ensure_local_nvm
    
      101    local electronDist="/usr/lib/electron${_electronversion}"
    
      102    NODE_ENV=production     pnpm run build:svelte
    
      103    NODE_ENV=production     pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config build.config.json"
    
      104}
    
      105package() {
    
      106    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      107    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
    
      108	local _app_dir=$(_get_app_dir)
    
      109	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
    
      110    install -Dm644 "${srcdir}/${pkgname}-${pkgver}/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      111    install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      112}
    
      113

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,9 +2,9 @@
 _appname=hugin
 pkgname="${_appname}-messenger"
 _pkgname='Hugin Messenger'
-pkgver=1.2.1
+pkgver=2.0.0
 _electronversion=30
-_nodeversion=20
+_nodeversion=22
 pkgrel=1
 pkgdesc="A secure and private messaging desktop application.(Use system-wide electron)"
 arch=('any')
@@ -28,13 +28,42 @@
     "${pkgname}-${pkgver}::git+${_ghurl}#tag=${pkgver}"
     "${pkgname}.sh"
 )
-sha256sums=('3dd7af3e4d41ac00a50a75a0a45b9ab07c719312867162c45af166d5fe185b42'
+sha256sums=('fc78ee41f80a9cc48efd000c283510e2a64c2596bbc1676c0d6996fbd3d544a5'
             'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
 _ensure_local_nvm() {
     local NVM_DIR="${srcdir}/.nvm"
     source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
     nvm install "${_nodeversion}"
     nvm use "${_nodeversion}"
+}
+_get_app_dir() {
+    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+}
+_set_build_env() {
+    export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+    export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
+    export HOME="${srcdir}/.electron-gyp"
+    {
+        export PNPM_LINK_WORKSPACE_PACKAGES=true
+        export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
+        export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
+        export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
+        export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
+        export PNPM_SHAMEFULLY_HOIST=true
+        export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
+        export PNPM_NODE_LINKER=hoisted
+        export PNPM_NETWORK_CONCURRENCY=32
+    }
+    if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
+        {
+            export pnpm_config_registry="https://registry.npmmirror.com"
+            export npm_config_registry="https://registry.npmmirror.com"
+            export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
+            export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
+            export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
+        }
+    fi
 }
 _get_electron_version() {
     _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
@@ -57,39 +86,27 @@
         --categories="Network" \
         --name="${_pkgname}" \
         --exec="${pkgname} %U"
-    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
-	export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
-	local HOME="${srcdir}/.electron-gyp"
-	export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
-	export NPM_CONFIG_MAXSOCKETS=32
-	if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
-		{
-			export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
-			export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
-			export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
-			export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
-			export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
-			export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
-		}
-		find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
-	fi
+    _set_build_env
     _ensure_local_nvm
     sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
-    NODE_ENV=development    npm add -D node-gyp
-    NODE_ENV=development    npm install
+    NODE_ENV=development    pnpm add -D node-gyp
+    NODE_ENV=development    pnpm install --frozen-lockfile
+    # Fix C++ standard mismatch: usb module builds with c++14 but Electron 30's
+    # V8 headers require c++17 (std::is_void_v, std::is_convertible_v, etc.)
+    sed -i 's|-std=c++14|-std=c++17|g' node_modules/usb/binding.gyp
 }
 build() {
     cd "${srcdir}/${pkgname}-${pkgver}"
     _ensure_local_nvm
     local electronDist="/usr/lib/electron${_electronversion}"
-    NODE_ENV=production     npm run build:svelte
-    NODE_ENV=production     npm exec -c "electron-builder --linux dir -c.electronDist=${electronDist} --config build.config.json"
+    NODE_ENV=production     pnpm run build:svelte
+    NODE_ENV=production     pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config build.config.json"
 }
 package() {
     install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
     install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
-    local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -exec dirname {} + | head -n 1)
-    cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname}/"
+	local _app_dir=$(_get_app_dir)
+	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
     install -Dm644 "${srcdir}/${pkgname}-${pkgver}/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
     install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 11:20:06	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2