inky

LOW

maintainer Dylan14 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx command is used to run @electron/packager on the locally built project source, which is a standard part of the build process for Electron apps and does not execute untrusted remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx command is used to run @electron/packager on the locally built project source, which is a standard part of the build process for Electron apps and does not execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:35 npx @electron/packager . Inky --platform=linux --arch=x64 --icon=resources/Icon.icns --extend-info=resources/info.plist --prune --asar.unpackDir="main-process/ink" --ignore="inklecate_mac"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dylan Delgado <dylan1496 at live dot com>
    
      2# Contributer: Felix Laurie von Massenbach <felix@erbridge.co.uk>
    
      3pkgname=inky
    
      4pkgver=0.15.2
    
      5pkgrel=1
    
      6pkgdesc="Editor for ink: inkle's narrative scripting language"
    
      7arch=('x86_64')
    
      8url="http://www.inklestudios.com/ink"
    
      9license=('MIT')
    
      10options=('!strip')
    
      11depends=('icu' 'electron')
    
      12conflicts=('inky-bin')
    
      13provides=('inky')
    
      14makedepends=('npm')
    
      15optdepends=('mono: for exporting to web and JSON')
    
      16source=("${pkgname}-${pkgver}.tar.gz::https://github.com/inkle/inky/archive/refs/tags/${pkgver}.tar.gz"
    
      17        "${pkgname}-${pkgver}.png::https://github.com/inkle/inky/raw/${pkgver}/resources/Icon1024.png"
    
      18        "${pkgname}.desktop")
    
      19sha512sums=('51a603539ac4e16f40948d51abee6f510df19dec43432107a7a521bac6699f81cf88ac1cc88d8d281c7824cbb23386977ec419a54c8ae170c7343c437e61a6bc'
    
      20            '9b88362b61635a2328bd2439aaeca7b26875e158b3c15f7317d0f0f26306891f48d147cd1d63602e36ee249880c0b500397a20cdff14e090a699925f37e18ef9'
    
      21            '84fd0f87bfdf5e1fd6df5f9e253e3aa71373b9ad28a1d027522eceb6cf94a9a370ef239bfe0738ce64efabb3685945fc40c054265418b0a639e26e4213211481')
    
      22
    
      23build() {
    
      24    cd "$srcdir/$pkgname-$pkgver"
    
      25
    
      26    rm -rf Inky-linux-x64/
    
      27    rm -rf ReleaseUpload
    
      28
    
      29    cd app
    
      30    # Update package.json to use latest electron and electron-packager
    
      31    sed -i '38 s/18.3.2/20.0.1/' package.json
    
      32    sed -i '41 s/30.0.4/42.3.0/' package.json
    
      33    npm install
    
      34
    
      35    npx @electron/packager . Inky --platform=linux --arch=x64 --icon=resources/Icon.icns --extend-info=resources/info.plist --prune --asar.unpackDir="main-process/ink" --ignore="inklecate_mac"
    
      36
    
      37    }
    
      38
    
      39package() {
    
      40    cd "$srcdir/"
    
      41    install -D -m644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      42    install -D -m644 "${pkgname}-${pkgver}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      43
    
      44    cd "$srcdir/$pkgname-$pkgver/app/Inky-linux-x64"
    
      45    
    
      46    install -d -m755 "${pkgdir}/usr/share/${pkgname}"
    
      47
    
      48    cp -a -r * "${pkgdir}/usr/share/${pkgname}"
    
      49
    
      50    install -D -m755 Inky "${pkgdir}/usr/share/${pkgname}/Inky"
    
      51
    
      52    install -d -m755 "${pkgdir}/usr/bin"
    
      53    ln -s "/usr/share/${pkgname}/Inky" "${pkgdir}/usr/bin/${pkgname}"
    
      54    cd "${pkgdir}/usr"
    
      55    rm -rf src/
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2