kanoprii

maintainer visorcraft · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command runs in offline mode using locally fetched npm dependencies, posing no remote code execution risk; the package builds from verified source and includes only data or project-owned binaries.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs in offline mode using locally fetched npm dependencies, posing no remote code execution risk; the package builds from verified source and includes only data or project-owned binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:64 npx --offline tauri build --no-bundle

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: VisorCraft LLC <packages@visorcraft.com>
    
      2
    
      3pkgname=kanoprii
    
      4pkgver=1.17.2
    
      5pkgrel=1
    
      6_pdfiumver=7947
    
      7pkgdesc='High-performance PDF editor'
    
      8arch=('x86_64')
    
      9url='https://github.com/visorcraft/Kanoprii'
    
      10license=('GPL-3.0-only' 'BSD-3-Clause' 'MIT')
    
      11depends=(
    
      12  'cairo'
    
      13  'dbus'
    
      14  'gcc-libs'
    
      15  'gdk-pixbuf2'
    
      16  'glib2'
    
      17  'glibc'
    
      18  'gtk3'
    
      19  'hicolor-icon-theme'
    
      20  'libcups'
    
      21  'libsoup3'
    
      22  'webkit2gtk-4.1'
    
      23)
    
      24makedepends=('cargo' 'npm' 'pkgconf')
    
      25conflicts=('kanoprii-bin' 'kanoprii-git')
    
      26options=('!lto')
    
      27source=(
    
      28  "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      29  "pdfium-linux-x64-$_pdfiumver.tgz::https://github.com/bblanchon/pdfium-binaries/releases/download/chromium/$_pdfiumver/pdfium-linux-x64.tgz"
    
      30  'kanoprii.desktop'
    
      31)
    
      32noextract=("pdfium-linux-x64-$_pdfiumver.tgz")
    
      33sha256sums=(
    
      34  '59c840260a8ff6a8c02d2f1d93bc2a9aebb4037649ed6104684b55a95fa6e4d8'
    
      35  'f73d69d309fe1f33cc7269dcc99be31ec44e1cf608e31d7e2fcc6545fc2f9323'
    
      36  '05dfa58465ff1838d64a870f5b7d4b8e456607fe8157ad9b60aeae65b56a860f'
    
      37)
    
      38
    
      39prepare() {
    
      40  cd "Kanoprii-$pkgver"
    
      41  export CARGO_HOME="$srcdir/cargo"
    
      42  export npm_config_cache="$srcdir/npm-cache"
    
      43
    
      44  npm ci
    
      45  cargo fetch --manifest-path src-tauri/Cargo.toml --locked \
    
      46    --target "$CARCH-unknown-linux-gnu"
    
      47
    
      48  install -d src-tauri/vendor/pdfium
    
      49  bsdtar -xf "$srcdir/pdfium-linux-x64-$_pdfiumver.tgz" \
    
      50    -C src-tauri/vendor/pdfium --strip-components 1 lib/libpdfium.so
    
      51  install -d "$srcdir/pdfium-licenses"
    
      52  bsdtar -xf "$srcdir/pdfium-linux-x64-$_pdfiumver.tgz" \
    
      53    -C "$srcdir/pdfium-licenses" LICENSE licenses
    
      54}
    
      55
    
      56build() {
    
      57  cd "Kanoprii-$pkgver"
    
      58  export CARGO_HOME="$srcdir/cargo"
    
      59  export CARGO_NET_OFFLINE=true
    
      60  export CARGO_PROFILE_RELEASE_LTO=false
    
      61  export npm_config_cache="$srcdir/npm-cache"
    
      62  export npm_config_offline=true
    
      63
    
      64  npx --offline tauri build --no-bundle
    
      65}
    
      66
    
      67check() {
    
      68  cd "Kanoprii-$pkgver"
    
      69  export CARGO_HOME="$srcdir/cargo"
    
      70  export CARGO_NET_OFFLINE=true
    
      71  export npm_config_cache="$srcdir/npm-cache"
    
      72  export npm_config_offline=true
    
      73
    
      74  npm run lint
    
      75  cargo test --manifest-path src-tauri/Cargo.toml --all-targets --frozen
    
      76}
    
      77
    
      78package() {
    
      79  cd "Kanoprii-$pkgver"
    
      80
    
      81  install -Dm755 src-tauri/target/release/kanoprii \
    
      82    "$pkgdir/usr/bin/kanoprii"
    
      83  install -Dm755 src-tauri/vendor/pdfium/libpdfium.so \
    
      84    "$pkgdir/usr/lib/Kanoprii/vendor/pdfium/libpdfium.so"
    
      85  install -Dm644 "$srcdir/kanoprii.desktop" \
    
      86    "$pkgdir/usr/share/applications/kanoprii.desktop"
    
      87
    
      88  install -Dm644 src-tauri/icons/32x32.png \
    
      89    "$pkgdir/usr/share/icons/hicolor/32x32/apps/kanoprii.png"
    
      90  install -Dm644 src-tauri/icons/64x64.png \
    
      91    "$pkgdir/usr/share/icons/hicolor/64x64/apps/kanoprii.png"
    
      92  install -Dm644 src-tauri/icons/128x128.png \
    
      93    "$pkgdir/usr/share/icons/hicolor/128x128/apps/kanoprii.png"
    
      94  install -Dm644 src-tauri/icons/128x128@2x.png \
    
      95    "$pkgdir/usr/share/icons/hicolor/256x256@2/apps/kanoprii.png"
    
      96  install -Dm644 src-tauri/icons/512x512.png \
    
      97    "$pkgdir/usr/share/icons/hicolor/512x512/apps/kanoprii.png"
    
      98
    
      99  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      100  install -Dm644 "$srcdir/pdfium-licenses/LICENSE" \
    
      101    "$pkgdir/usr/share/licenses/$pkgname/PDFium-Binaries-LICENSE"
    
      102  cp -a "$srcdir/pdfium-licenses/licenses/." \
    
      103    "$pkgdir/usr/share/licenses/$pkgname/"
    
      104  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      105  install -Dm644 CREDITS.md "$pkgdir/usr/share/doc/$pkgname/CREDITS.md"
    
      106}
    
      107

Changes since previous scan

--- PKGBUILD @ 2026-07-23 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: VisorCraft LLC <packages@visorcraft.com>
 
 pkgname=kanoprii
-pkgver=1.17.1
+pkgver=1.17.2
 pkgrel=1
 _pdfiumver=7947
 pkgdesc='High-performance PDF editor'
@@ -31,7 +31,7 @@
 )
 noextract=("pdfium-linux-x64-$_pdfiumver.tgz")
 sha256sums=(
-  'b1e84de49fa1756a26a7e6304f2153e8f16ce93bf1826f040ba146bab6909509'
+  '59c840260a8ff6a8c02d2f1d93bc2a9aebb4037649ed6104684b55a95fa6e4d8'
   'f73d69d309fe1f33cc7269dcc99be31ec44e1cf608e31d7e2fcc6545fc2f9323'
   '05dfa58465ff1838d64a870f5b7d4b8e456607fe8157ad9b60aeae65b56a860f'
 )
@@ -57,6 +57,7 @@
   cd "Kanoprii-$pkgver"
   export CARGO_HOME="$srcdir/cargo"
   export CARGO_NET_OFFLINE=true
+  export CARGO_PROFILE_RELEASE_LTO=false
   export npm_config_cache="$srcdir/npm-cache"
   export npm_config_offline=true
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 23:26:18	MEDIUM	2
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 01:12:32	MEDIUM	2
2026-07-20 00:19:49	LOW	3
2026-07-19 15:12:45	LOW	3
2026-07-19 15:11:12	MEDIUM	2