jlc-assistant-bin
MEDIUM
maintainer taotieren
4 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The prepare() function runs 'npm install' on external packages '@motrix/nat-api' and 'aria2-lib' without declaring them as dependencies, introducing a supply-chain risk from unverified remote sources.
Triggered rules
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:70
npm install aria2-lib @motrix/nat-api --save
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:28
"${pkgname%-bin}-${pkgver}.zip::https://download.jlc.com/pcAssit/${pkgver}/JLCPcAssit-linux-x64-${pkgver}.zip"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The prepare() function runs 'npm install' on external packages '@motrix/nat-api' and 'aria2-lib' without declaring them as dependencies, introducing a supply-chain risk from unverified remote sources.
PKGBUILD
2 offending line(s) highlighted
1
# Contributor: taotieren <admin@taotieren.com>
2
3
pkgname=jlc-assistant-bin
4
_pkgname=${pkgname%-bin}
5
pkgver=5.0.69
6
pkgrel=28
7
pkgdesc="嘉立创下单助手:该应用为您下单提供便利，快速获取优惠及下单信息，无需在网站等待审核审单！在下单助手下单立享打折优惠！ "
8
arch=('x86_64')
9
url="https://www.jlc.com/portal/appDownloadsWithConfig.html"
10
license=('LicenseRef-custom')
11
provides=(${pkgname%-bin})
12
conflicts=(${pkgname%-bin})
13
replaces=(${pkgname%-bin})
14
_electronversion=19
15
_electronpkg=electron${_electronversion}
16
depends=(
17
${_electronpkg}
18
nodejs
19
)
20
makedepends=(
21
'asar'
22
'npm'
23
)
24
backup=()
25
options=('!emptydirs')
26
install=
27
source=(
28
"${pkgname%-bin}-${pkgver}.zip::https://download.jlc.com/pcAssit/${pkgver}/JLCPcAssit-linux-x64-${pkgver}.zip"
29
"${pkgname%-bin}.sh"
30
)
31
sha256sums=('d943ebf9ee328a657cd608bdf301f637ea48988b57adeae1ae770fae944caacd'
32
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
33
noextract=()
34
35
_get_app_dir() {
36
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
37
}
38
_check_electron_version() {
39
echo "Verifying Electron version..."
40
local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
41
[[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
42
local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
43
[[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
44
[[ "${_elec_ver}" != "${_electronversion}" ]] &&
45
echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
46
echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
47
}
48
prepare() {
49
sed -i -e "
50
s/@electronversion@/${_electronversion}/g
51
s/@appname@/${pkgname%-bin}/g
52
s/@runname@/app.asar/g
53
s/@cfgdirname@/${_pkgname}/g
54
" "${srcdir}/${pkgname%-bin}.sh"
55
56
if [ -d "${srcdir}/squashfs-root" ];then
57
rm -rf "${srcdir}/squashfs-root"
58
fi
59
60
_check_electron_version
61
local _app_dir=$(_get_app_dir)
62
sed -i -e "s|^Exec=.*|Exec=${_pkgname} %f|" \
63
-e "s|^Icon=.*|Icon=${_pkgname}|" \
64
"${_app_dir}/${_pkgname}.dkt"
65
asar e "${_app_dir}/resources/app.asar" "${srcdir}/app.asar.unpacked"
66
rm -rf "${_app_dir}/resources/app.asar"
67
cd "${srcdir}/app.asar.unpacked"
68
sed -i '/"packageManager"/d' package.json
69
npm config set allow-remote all
70
npm install aria2-lib @motrix/nat-api --save
71
cd - > /dev/null
72
asar p "${srcdir}/app.asar.unpacked" "${_app_dir}/resources/app.asar"
73
find "${_app_dir}/resources" -type d -perm 700 -exec chmod 755 {} +
74
}
75
package() {
76
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
77
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
78
local _app_dir=$(_get_app_dir)
79
cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
80
for _i in "${_app_dir}"/icon/png/*.png; do
81
[[ -f "${_i}" ]] || continue
82
_size="${_i##*/}"
83
_size="${_size%.png}"
84
install -Dm644 "${_i}" \
85
"${pkgdir}/usr/share/icons/hicolor/${_size}x${_size}/apps/${pkgname%-bin}.png"
86
done
87
install -Dm644 "${_app_dir}/${pkgname%-bin}.dkt" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
88
}
89
Changes since previous scan
--- PKGBUILD @ 2026-09-14 00:27+++ PKGBUILD @ 2026-09-17 00:27@@ -3,7 +3,7 @@ pkgname=jlc-assistant-bin _pkgname=${pkgname%-bin} pkgver=5.0.69-pkgrel=27+pkgrel=28 pkgdesc="嘉立创下单助手:该应用为您下单提供便利，快速获取优惠及下单信息，无需在网站等待审核审单！在下单助手下单立享打折优惠！ " arch=('x86_64') url="https://www.jlc.com/portal/appDownloadsWithConfig.html"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 3 |
| 2026-09-16 00:03:17 | Medium | 3 |
| 2026-09-15 00:25:31 | Medium | 3 |
| 2026-09-14 13:17:35 | Medium | 3 |
| 2026-09-14 00:27:57 | Medium | 3 |
| 2026-09-13 00:19:54 | Medium | 3 |
| 2026-09-12 00:25:17 | Medium | 3 |
| 2026-09-11 00:19:22 | Medium | 3 |
| 2026-09-10 00:22:44 | Medium | 3 |
| 2026-09-09 00:04:09 | Medium | 3 |
| 2026-09-08 00:18:08 | Medium | 3 |
| 2026-09-07 00:30:15 | Medium | 3 |
| 2026-09-06 00:17:06 | Medium | 3 |
| 2026-09-05 00:16:27 | Medium | 3 |
| 2026-09-04 00:03:13 | Medium | 3 |
| 2026-09-03 00:15:47 | Medium | 3 |
| 2026-09-02 00:02:31 | Medium | 3 |
| 2026-09-01 11:47:58 | Medium | 3 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |