inkstone-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-11-06 08:13:39.601626
View on AUR
Why flagged

The prepare() step globally installs '@earendil-works/pi-coding-agent' from npm registry (npm install -g) - an undeclared external package from a personal/project namespace that gets executed during build, representing a supply-chain risk if that package were compromised or swapped; combined with few votes and recent upload this warrants medium severity.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:109 npm install -g "@earendil-works/pi-coding-agent"
  • PKGBUILD:110 npm add -D node-pty
Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): The prepare() step globally installs '@earendil-works/pi-coding-agent' from npm registry (npm install -g) - an undeclared external package from a personal/project namespace that gets executed during build, representing a supply-chain risk if that package were compromised or swapped; combined with few votes and recent upload this warrants medium severity.

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=inkstone-git
3_pkgname=Inkstone
4_zhsname='砚'
5pkgver=0.14.0.r1.g1eed44f
6_electronversion=45
7_nodeversion=24
8pkgrel=1
9pkgdesc="A lightweight desktop client for pi, with MCP and project workspaces."
10arch=('any')
11url="https://github.com/Yu-DaTouX/Inkstone"
12license=('MIT')
13conflicts=("${pkgname%-git}")
14provides=("${pkgname%-git}=${pkgver%.r*}")
15depends=(
16 "electron${_electronversion}"
17 'nodejs'
18 'python'
19)
20makedepends=(
21 'npm'
22 'git'
23 'nvm'
24 'gendesk'
25 'jq'
26)
27source=(
28 "${pkgname//-/.}::git+${url}.git"
29 "${pkgname%-git}.js"
30 "${pkgname%-git}.sh"
31)
32sha256sums=('SKIP'
33 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
34 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
35_get_project_dir() {
36 local d
37 while IFS= read -r d; do
38 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
39 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
40}
41pkgver() {
42 cd "$(_get_project_dir)"
43 set -o pipefail
44 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
45 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
46}
47_ensure_local_nvm() {
48 local NVM_DIR="${srcdir}/.nvm"
49 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
50 nvm install "${_nodeversion}"
51 nvm use "${_nodeversion}"
52}
53_get_app_dir() {
54 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
55 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
56}
57_get_electron_version() {
58 local _v
59 _v=$(jq -r '.. | (.electron? // empty) | strings' "$(_get_project_dir)/package.json" 2>/dev/null | head -1)
60 [[ -z "$_v" ]] && _v=$(grep -oE 'electron@[0-9.]+' "$(_get_project_dir)/pnpm-lock.yaml" 2>/dev/null | head -1 | sed 's/^electron@//')
61 [[ -z "$_v" ]] && _v=$(grep -oE 'electron@npm:[0-9.]+' "$(_get_project_dir)/yarn.lock" 2>/dev/null | head -1 | sed 's/^electron@npm://')
62 [[ -z "$_v" ]] && _v=$(jq -r '.packages["node_modules/electron"].version // empty' "$(_get_project_dir)/package-lock.json" 2>/dev/null | head -1)
63 [[ -z "$_v" ]] && _v=$(grep -oE 'electron: ?\[?"?npm:?[0-9.]+' "$(_get_project_dir)/bun.lock" 2>/dev/null | grep -oE '[0-9.]+' | head -1)
64 [[ -z "$_v" ]] && return 1
65 _v="$(printf '%s' "$_v" | sed 's/^[^0-9]*//')"
66 [[ "$_v" =~ ^[0-9] ]] || return 1
67 _v="${_v%%.*}"
68 (( ${_v} == _electronversion )) && echo -e "\033[1;32mElectron version: ${_v}\033[0m" || echo -e "\033[1;31mElectron version: ${_v} (expected ${_electronversion})\033[0m"
69}
70_set_electron_build_env() {
71 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
72 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
73 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
74 export ELECTRON_BUILDER_OFFLINE=true
75 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
76}
77_set_npm_build_env() {
78 export HOME="${srcdir}/.home"
79 export XDG_CACHE_HOME="${HOME}/.cache"
80 export XDG_CONFIG_HOME="${HOME}/.config"
81 export XDG_DATA_HOME="${HOME}/.local/share"
82 export npm_config_cache="${HOME}/.npm_cache"
83 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
84 export COREPACK_HOME="${HOME}/.corepack"
85 export npm_config_audit=false
86 export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
87 mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
88}
89prepare() {
90 cd "$(_get_project_dir)"
91 _get_electron_version
92 sed -i -e "
93 s/@electronversion@/${_electronversion}/g
94 s/@appname@/${pkgname%-git}/g
95 " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
96 gendesk -q -f -n \
97 --pkgname="${pkgname%-git}" \
98 --pkgdesc="${pkgdesc}" \
99 --categories="Development" \
100 --name="${_pkgname}" \
101 --exec="${pkgname%-git} %U" \
102 --custom=Name[zh]="${_zhsname}"
103 _ensure_local_nvm
104 _set_electron_build_env
105 _set_npm_build_env
106 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
107 export NODE_ENV=development
108 npm install
109 npm install -g "@earendil-works/pi-coding-agent"
110 npm add -D node-pty
111}
112build() {
113 cd "$(_get_project_dir)"
114 _ensure_local_nvm
115 _set_electron_build_env
116 _set_npm_build_env
117 export NODE_ENV=production
118 npm run vendor:pi
119 npm run build
120 npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
121 rm -rf "$(_get_app_dir)/resources/default_app.asar"
122 local _archrem=$([[ "${CARCH}" == "aarch64" ]] && echo x64 || echo arm)
123 find "$(_get_app_dir)" -type d \
124 \( -name '*darwin*' -o -name '*android*' -o -name 'win32*' -o -name "*ia32*" -o -name "*${_archrem}*" \) \
125 -prune -exec rm -rf {} +
126}
127package() {
128 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
129 install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
130 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
131 install -Dm644 "$(_get_project_dir)/build/icon.png" "${pkgdir}/usr/share/icons/hicolor/64x64/apps/${pkgname%-git}.png"
132 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
133 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
134}
135

Scan history

Scanned at (UTC)SeverityRules
2026-11-06 08:13:39 Medium 3
2026-11-06 08:11:27 Medium 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion