justwrite-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-09-24 01:41:16.165362
View on AUR
Why flagged

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:98 bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=justwrite-git
3_pkgname='简单写作️'
4pkgver=r1.5cc0437
5_electronversion=44
6_nodeversion=24
7pkgrel=1
8pkgdesc="A cross platform Markdown editor that supports synchronized sliding preview.一款支持同步滑动预览的跨平台Markdown编辑器."
9arch=('any')
10url="https://github.com/onblog/JustWrite"
11license=('GPL-3.0-only')
12conflicts=("${pkgname%-git}")
13provides=("${pkgname%-git}=${pkgver%.r*}")
14depends=(
15 "electron${_electronversion}"
16)
17makedepends=(
18 'bun'
19 'git'
20 'nvm'
21 'gendesk'
22 'jq'
23)
24source=(
25 "${pkgname//-/.}::git+${url}.git"
26 "${pkgname%-git}.sh"
27)
28sha256sums=('SKIP'
29 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
30pkgver() {
31 cd "${srcdir}/${pkgname//-/.}"
32 set -o pipefail
33 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
34 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
35}
36_ensure_local_nvm() {
37 local NVM_DIR="${srcdir}/.nvm"
38 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
39 nvm install "${_nodeversion}"
40 nvm use "${_nodeversion}"
41}
42_get_app_dir() {
43 find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
44}
45_get_electron_version() {
46 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
47 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
48 [[ -z "${_elec_ver}" ]] && return 1
49 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
50}
51_set_build_env() {
52 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
53 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
54 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
55 export ELECTRON_BUILDER_OFFLINE=true
56 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
57 export HOME="${srcdir}/.home"
58 export XDG_CACHE_HOME="${HOME}/.cache"
59 export XDG_CONFIG_HOME="${HOME}/.config"
60 export XDG_DATA_HOME="${HOME}/.local/share"
61 export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
62 export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
63 export BUN_INSTALL_BIN="${HOME}/.bun/bin"
64 export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
65 export BUN_CONFIG_SKIP_LOAD_LOCKFILE=1
66 export BUN_DISABLE_DOTENV=1
67 export DO_NOT_TRACK=1
68 export BUN_JOBS="$(nproc)"
69 mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
70}
71prepare() {
72 cd "${srcdir}/${pkgname//-/.}"
73 _get_electron_version
74 sed -i -e "
75 s/@electronversion@/${_electronversion}/g
76 s/@appname@/${pkgname%-git}/g
77 s/@runname@/app.asar/g
78 s/@cfgdirname@/${pkgname%-git}/g
79 s/@options@//g
80 " "${srcdir}/${pkgname%-git}.sh"
81 gendesk -q -f -n \
82 --pkgname="${pkgname%-git}" \
83 --pkgdesc="${pkgdesc}" \
84 --categories="Office" \
85 --name="${_pkgname}" \
86 --exec="${pkgname%-git} %U"
87 _ensure_local_nvm
88 _set_build_env
89 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g;s/app\.ico/app\.png/g" package.json
90 export NODE_ENV=development
91 bun install
92}
93build() {
94 cd "${srcdir}/${pkgname//-/.}"
95 _ensure_local_nvm
96 _set_build_env
97 export NODE_ENV=production
98 bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
99}
100package() {
101 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
102 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
103 local _app_dir=$(_get_app_dir)
104 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
105 install -Dm644 "${srcdir}/${pkgname//-/.}/build/app.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
106 install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
107 install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
108}
109

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-09-24 01:41
@@ -1,11 +1,11 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=justwrite-git
_pkgname='简单写作️'
-pkgver=r3.1cbd108
-_electronversion=6
-_nodeversion=16
+pkgver=r1.5cc0437
+_electronversion=44
+_nodeversion=24
pkgrel=1
-pkgdesc="A cross platform Markdown editor that supports synchronized sliding preview.Use system-wide electron.一款支持同步滑动预览的跨平台Markdown编辑器."
+pkgdesc="A cross platform Markdown editor that supports synchronized sliding preview.一款支持同步滑动预览的跨平台Markdown编辑器."
arch=('any')
url="https://github.com/onblog/JustWrite"
license=('GPL-3.0-only')
@@ -15,18 +15,18 @@
"electron${_electronversion}"
)
makedepends=(
- 'npm'
+ 'bun'
'git'
'nvm'
'gendesk'
- 'curl'
+ 'jq'
)
source=(
"${pkgname//-/.}::git+${url}.git"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
pkgver() {
cd "${srcdir}/${pkgname//-/.}"
set -o pipefail
@@ -39,7 +39,38 @@
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
+_get_app_dir() {
+ find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
+}
+_get_electron_version() {
+ _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
+ -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+}
+_set_build_env() {
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
+ export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
+ export BUN_INSTALL_BIN="${HOME}/.bun/bin"
+ export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
+ export BUN_CONFIG_SKIP_LOAD_LOCKFILE=1
+ export BUN_DISABLE_DOTENV=1
+ export DO_NOT_TRACK=1
+ export BUN_JOBS="$(nproc)"
+ mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
+}
prepare() {
+ cd "${srcdir}/${pkgname//-/.}"
+ _get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
@@ -47,37 +78,32 @@
s/@cfgdirname@/${pkgname%-git}/g
s/@options@//g
" "${srcdir}/${pkgname%-git}.sh"
+ gendesk -q -f -n \
+ --pkgname="${pkgname%-git}" \
+ --pkgdesc="${pkgdesc}" \
+ --categories="Office" \
+ --name="${_pkgname}" \
+ --exec="${pkgname%-git} %U"
_ensure_local_nvm
- gendesk -q -f -n --pkgname="${pkgname%-git}" --pkgdesc="${pkgdesc}" --categories="Office" --name="${_pkgname}" --exec="${pkgname%-git} %U"
- cd "${srcdir}/${pkgname//-/.}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- HOME="${srcdir}/.electron-gyp"
- {
- echo -e '\n'
- #echo 'build_from_source=true'
- echo "cache=${srcdir}/.npm_cache"
- } >> .npmrc
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- echo 'registry=https://registry.npmmirror.com'
- echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
- echo 'electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/'
- } >> .npmrc
- find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
- fi
+ _set_build_env
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g;s/app\.ico/app\.png/g" package.json
- NODE_ENV=development npm install
+ export NODE_ENV=development
+ bun install
}
build() {
cd "${srcdir}/${pkgname//-/.}"
- local electronDist="/usr/lib/electron${_electronversion}"
- NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${electronDist}"
+ _ensure_local_nvm
+ _set_build_env
+ export NODE_ENV=production
+ bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm644 "${srcdir}/${pkgname//-/.}/dist/linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"
+ install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
+ local _app_dir=$(_get_app_dir)
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
install -Dm644 "${srcdir}/${pkgname//-/.}/build/app.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
- install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-09-24 01:41:16 Medium 1
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion