image-stitching-git

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The npm install runs in a controlled build environment using the project's own package.json and lockfile, with registry fallbacks for reliability; it does not install undeclared external packages or execute untrusted code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npm install runs in a controlled build environment using the project's own package.json and lockfile, with registry fallbacks for reliability; it does not install undeclared external packages or execute untrusted code.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:80 NODE_ENV=development npm add -D @electron-forge/plugin-local-electron

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=image-stitching-git
3_appname='AI Image Stitcher'
4pkgver=1.4.r1.gf07e2cd
5_electronversion=27
6_nodeversion=20
7pkgrel=1
8pkgdesc="This Image Stitcher was specifically built to stitch images in a horizontal layout one after the other from left to right. Primarily used for stitching multiple seperate images of a single scratch together.(Use system-wide electron)"
9arch=('any')
10url="https://github.com/DevanshuSawant/image-stitching-electron-app"
11license=('MIT')
12conflicts=("${pkgname%-git}")
13provides=("${pkgname%-git}=${pkgver%.r*}")
14depends=(
15 "electron${_electronversion}"
16)
17makedepends=(
18 'gendesk'
19 'npm'
20 'nvm'
21 'curl'
22 'git'
23 'python'
24 'python-setuptools'
25)
26source=(
27 "${pkgname%-git}.git::git+${url}.git"
28 "${pkgname%-git}.sh"
29)
30sha256sums=('SKIP'
31 '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
32pkgver() {
33 cd "${srcdir}/${pkgname%-git}.git"
34 set -o pipefail
35 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
36 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
37}
38_ensure_local_nvm() {
39 local NVM_DIR="${srcdir}/.nvm"
40 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
41 nvm install "${_nodeversion}"
42 nvm use "${_nodeversion}"
43}
44prepare() {
45 cd "${srcdir}/${pkgname%-git}.git"
46 sed -i -e "
47 s/@electronversion@/${_electronversion}/g
48 s/@appname@/${pkgname%-git}/g
49 s/@runname@/app.asar/g
50 s/@cfgdirname@/${pkgname%-git}/g
51 s/@options@//g
52 " -i "${srcdir}/${pkgname%-git}.sh"
53 _ensure_local_nvm
54 gendesk -f -n -q \
55 --pkgname="${pkgname%-git}" \
56 --pkgdesc="${pkgdesc}" \
57 --categories="Graphics" \
58 --name="${_appname}" \
59 --exec="${pkgname%-git} %U"
60 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
61 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
62 HOME="${srcdir}/.electron-gyp"
63 {
64 echo -e '\n'
65 #echo 'build_from_source=true'
66 echo "cache=${srcdir}/.npm_cache"
67 echo "maxsockets=10"
68 } >> .npmrc
69 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
70 {
71 echo 'registry=https://registry.npmmirror.com'
72 echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
73 echo 'electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/'
74 } >> .npmrc
75 find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
76 fi
77 sed -i "s/\/\/ asar/asar/g" forge.config.js
78 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
79 NODE_ENV=development npm install
80 NODE_ENV=development npm add -D @electron-forge/plugin-local-electron
81}
82build() {
83 cd "${srcdir}/${pkgname%-git}.git"
84 local electronDist="/usr/lib/electron${_electronversion}"
85 sed -i -e "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
86 {\\
87 name: \"@electron-forge/plugin-local-electron\",\\
88 config: {\\
89 electronPath: \"${electronDist}\"\\
90 }\\
91 }," forge.config.*
92 NODE_ENV=production npm run package
93}
94package() {
95 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
96 install -Dm644 "${srcdir}/${pkgname%-git}.git/out/${_appname}-linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"
97 install -Dm644 "${srcdir}/${pkgname%-git}.git/src/assets/square-smt-logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}"
98 install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
99 install -Dm644 "${srcdir}/${pkgname%-git}.git/package.json" -t "${pkgdir}/usr/share/licenses/${pkgname}"
100}

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion