inky

maintainer Dylan14 · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command is used to run @electron/packager on the locally built project source, which is a standard part of the build process for Electron apps and does not execute untrusted remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx command is used to run @electron/packager on the locally built project source, which is a standard part of the build process for Electron apps and does not execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:35 npx @electron/packager . Inky --platform=linux --arch=x64 --icon=resources/Icon.icns --extend-info=resources/info.plist --prune --asar.unpackDir="main-process/ink" --ignore="inklecate_mac"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dylan Delgado <dylan1496 at live dot com>
    
      2# Contributer: Felix Laurie von Massenbach <felix@erbridge.co.uk>
    
      3pkgname=inky
    
      4pkgver=0.15.2
    
      5pkgrel=1
    
      6pkgdesc="Editor for ink: inkle's narrative scripting language"
    
      7arch=('x86_64')
    
      8url="http://www.inklestudios.com/ink"
    
      9license=('MIT')
    
      10options=('!strip')
    
      11depends=('icu' 'electron')
    
      12conflicts=('inky-bin')
    
      13provides=('inky')
    
      14makedepends=('npm')
    
      15optdepends=('mono: for exporting to web and JSON')
    
      16source=("${pkgname}-${pkgver}.tar.gz::https://github.com/inkle/inky/archive/refs/tags/${pkgver}.tar.gz"
    
      17        "${pkgname}-${pkgver}.png::https://github.com/inkle/inky/raw/${pkgver}/resources/Icon1024.png"
    
      18        "${pkgname}.desktop")
    
      19sha512sums=('51a603539ac4e16f40948d51abee6f510df19dec43432107a7a521bac6699f81cf88ac1cc88d8d281c7824cbb23386977ec419a54c8ae170c7343c437e61a6bc'
    
      20            '9b88362b61635a2328bd2439aaeca7b26875e158b3c15f7317d0f0f26306891f48d147cd1d63602e36ee249880c0b500397a20cdff14e090a699925f37e18ef9'
    
      21            '84fd0f87bfdf5e1fd6df5f9e253e3aa71373b9ad28a1d027522eceb6cf94a9a370ef239bfe0738ce64efabb3685945fc40c054265418b0a639e26e4213211481')
    
      22
    
      23build() {
    
      24    cd "$srcdir/$pkgname-$pkgver"
    
      25
    
      26    rm -rf Inky-linux-x64/
    
      27    rm -rf ReleaseUpload
    
      28
    
      29    cd app
    
      30    # Update package.json to use latest electron and electron-packager
    
      31    sed -i '38 s/18.3.2/20.0.1/' package.json
    
      32    sed -i '41 s/30.0.4/42.3.0/' package.json
    
      33    npm install
    
      34
    
      35    npx @electron/packager . Inky --platform=linux --arch=x64 --icon=resources/Icon.icns --extend-info=resources/info.plist --prune --asar.unpackDir="main-process/ink" --ignore="inklecate_mac"
    
      36
    
      37    }
    
      38
    
      39package() {
    
      40    cd "$srcdir/"
    
      41    install -D -m644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      42    install -D -m644 "${pkgname}-${pkgver}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      43
    
      44    cd "$srcdir/$pkgname-$pkgver/app/Inky-linux-x64"
    
      45    
    
      46    install -d -m755 "${pkgdir}/usr/share/${pkgname}"
    
      47
    
      48    cp -a -r * "${pkgdir}/usr/share/${pkgname}"
    
      49
    
      50    install -D -m755 Inky "${pkgdir}/usr/share/${pkgname}/Inky"
    
      51
    
      52    install -d -m755 "${pkgdir}/usr/bin"
    
      53    ln -s "/usr/share/${pkgname}/Inky" "${pkgdir}/usr/bin/${pkgname}"
    
      54    cd "${pkgdir}/usr"
    
      55    rm -rf src/
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2