hydrogen-music
LOW
maintainer zxp19821005
0 votes
scanned 2026-09-09 09:22:43.861996
Why flagged
The `bunx electron-builder` call executes a package from the npm registry, which is a standard build tool for Electron apps rather than a remote code execution risk; the source tarball is from the project's own GitHub with a verified checksum, and the CN mirror substitution is a legitimate regional optimization, not traffic hijacking.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The `bunx electron-builder` call executes a package from the npm registry, which is a standard build tool for Electron apps rather than a remote code execution risk; the source tarball is from the project's own GitHub with a verified checksum, and the CN mirror substitution is a legitimate regional optimization, not traffic hijacking.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:88
bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.config.cjs
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=hydrogen-music
3
_pkgname=Hydrogen-Music
4
pkgver=0.6.3
5
_electronversion=38
6
_nodeversion=22
7
pkgrel=1
8
pkgdesc="Arknights-style third-party NetEase Cloud Music player built with Electron and Vue 3."
9
arch=('x86_64')
10
url="https://github.com/ldx123000/Hydrogen-Music"
11
license=('MIT')
12
depends=(
13
"electron${_electronversion}"
14
'ffmpeg'
15
)
16
makedepends=(
17
'npm'
18
'nvm'
19
'git'
20
'curl'
21
'yarn'
22
'jq'
23
)
24
source=(
25
"${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
26
"${pkgname}.sh"
27
)
28
sha256sums=('61a97966def56f043536fd2875c55ffac0b303576fce7608ee69ed4a768376c3'
29
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
30
_ensure_local_nvm() {
31
local NVM_DIR="${srcdir}/.nvm"
32
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
33
nvm install "${_nodeversion}"
34
nvm use "${_nodeversion}"
35
}
36
_set_build_env() {
37
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
38
export ELECTRON_OVERRIDE_DIST_PATH="${electronDist}"
39
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
40
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
41
export HOME="${srcdir}/.electron-gyp"
42
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
43
export BUN_CONFIG_REGISTRY="https://registry.npmmirror.com"
44
export npm_config_registry="https://registry.npmmirror.com"
45
export BUN_INSTALL_DISABLE_DEFAULT_REGISTRY_FALLBACK=1
46
export npm_config_nodejs_org_mirror="https://npmmirror.com/mirrors/node"
47
export NVM_NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
48
export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron"
49
export npm_config_electron_mirror="https://npmmirror.com/mirrors/electron/"
50
export BUN_BINARY_MIRROR_OVERRIDE="https://npmmirror.com/-/binary/"
51
find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
52
fi
53
}
54
_get_app_dir() {
55
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
56
}
57
_get_electron_version() {
58
_elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
59
-exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
60
[[ -z "${_elec_ver}" ]] && return 1
61
echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
62
}
63
prepare() {
64
cd "${srcdir}/${_pkgname}-${pkgver}"
65
_get_electron_version
66
sed -i -e "
67
s/@electronversion@/${_electronversion}/g
68
s/@appname@/${pkgname}/g
69
s/@runname@/app.asar/g
70
s/@cfgdirname@/${pkgname//-/}/g
71
" "${srcdir}/${pkgname}.sh"
72
gendesk -q -f -n \
73
--pkgname="${pkgname}" \
74
--pkgdesc="${pkgdesc}" \
75
--categories="Graphics;Utility" \
76
--name="${_pkgname}" \
77
--exec="${pkgname} %U"
78
_set_build_env
79
_ensure_local_nvm
80
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
81
bun install
82
}
83
build() {
84
cd "${srcdir}/${_pkgname}-${pkgver}"
85
_set_build_env
86
_ensure_local_nvm
87
bun run build
88
bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.config.cjs
89
local _app_dir=$(_get_app_dir)
90
ln -sf "/usr/bin/ffmpeg" "${_app_dir}/resources/app.asar.unpacked/node_modules/ffmpeg-static/ffmpeg"
91
}
92
package() {
93
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
94
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
95
local _app_dir=$(_get_app_dir)
96
cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
97
rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
98
install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/img/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
99
install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
100
install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
101
}
102
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-09 09:22:43 | Low | 3 |
| 2026-09-09 09:19:26 | Medium | 2 |