keeweb

maintainer alessi0 · 18 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx commands execute grunt and electron-rebuild on the project's own source code from its official GitHub repositories, which is a standard part of building the application and does not involve executing untrusted remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx commands execute grunt and electron-rebuild on the project's own source code from its official GitHub repositories, which is a standard part of building the application and does not involve executing untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:84 npx grunt build-web-app build-desktop-app-content
PKGBUILD:101 npx electron-rebuild --arch="${_arch}" --version="$(</usr/lib/${_electron}/version)" --only=argon2,keytar,usb-detection,yubikey-chalresp,keyboard-auto-type

PKGBUILD

2 offending line(s) highlighted

      1# vim: noexpandtab tabstop=4 shiftwidth=4 softtabstop=4
    
      2# Maintainer: Peter Cai <peter@typeblog.net>
    
      3# Contributor: <surefire@cryptomile.net>
    
      4
    
      5pkgname=keeweb
    
      6pkgver=1.18.7
    
      7_electron=electron12
    
      8pkgrel=1
    
      9pkgdesc="Desktop password manager compatible with KeePass databases"
    
      10arch=('any')
    
      11url="https://keeweb.info"
    
      12license=('MIT')
    
      13depends=(
    
      14	"$_electron"
    
      15	'org.freedesktop.secrets'
    
      16)
    
      17makedepends=(
    
      18	'asar'
    
      19	'git'
    
      20	'libsass'
    
      21	'npm'
    
      22	'nodejs'
    
      23	'cmake'
    
      24)
    
      25conflicts=('keeweb-desktop')
    
      26source=(
    
      27	"${pkgname}::git+https://github.com/keeweb/keeweb.git#tag=v${pkgver}"
    
      28	"git+https://github.com/keeweb/keeweb-native-modules.git#tag=0.11.7"
    
      29	"git+https://github.com/keeweb/keeweb-connect.git#tag=0.3.7"
    
      30	'package.json.patch.js'
    
      31	'67e917af3dcd9d78273774e7061f74d893b5523b.patch'
    
      32)
    
      33
    
      34sha1sums=('SKIP'
    
      35          'SKIP'
    
      36          'SKIP'
    
      37          '679f19fcdff4a8df49bb0bd8ee09eab1784cf264'
    
      38          '3b6341f657421899d4e4078b799bece7d93587e5')
    
      39
    
      40case "$CARCH" in
    
      41	i686)    _arch=ia32;;
    
      42	x86_64)  _arch=x64;;
    
      43	aarch64) _arch=arm64;;
    
      44	*)       _arch=DUMMY;;
    
      45esac
    
      46
    
      47prepare() {
    
      48	cd "${srcdir}/${pkgname}"
    
      49
    
      50	# remove extra dependencies
    
      51	node ../package.json.patch.js
    
      52
    
      53	sed -i \
    
      54		-e "/const electronVersion/  s/pkg.dependencies.electron/'$(</usr/lib/${_electron}/version)'/" \
    
      55	Gruntfile.js
    
      56
    
      57	sed -i \
    
      58		-e "/'eslint',/  d" \
    
      59	grunt.tasks.js
    
      60
    
      61	sed -i \
    
      62		-e "/const BundleAnalyzerPlugin/              d" \
    
      63		-e "/new BundleAnalyzerPlugin({$/, /^\s*})$/  d" \
    
      64	build/webpack.config.js
    
      65
    
      66	# Patch `getNativeMessagingHostPath` to not rely on the executable path
    
      67	# (in our case, the executable path is the system electron binary)
    
      68	sed -i \
    
      69		-e 's@function getNativeMessagingHostPath() {@function getNativeMessagingHostPath() {\nreturn "/usr/lib/keeweb/keeweb-native-messaging-host";@' \
    
      70	desktop/scripts/util/browser-extension-installer.js
    
      71}
    
      72
    
      73build() {
    
      74	export npm_config_build_from_source=true
    
      75	export npm_config_optional=false
    
      76
    
      77	cd "${srcdir}/${pkgname}"
    
      78
    
      79	SKIP_SASS_BINARY_DOWNLOAD_FOR_CI=1 \
    
      80	SASS_FORCE_BUILD=1 \
    
      81	LIBSASS_EXT=auto \
    
      82	npm install --nodedir=/usr
    
      83
    
      84	npx grunt build-web-app build-desktop-app-content
    
      85
    
      86	asar p tmp/desktop/app tmp/desktop/app.asar
    
      87
    
      88	cat <<-EOF > tmp/desktop/keeweb
    
      89		#!/usr/bin/sh
    
      90		exec ${_electron} /usr/lib/keeweb/app.asar --disable-updater "\$@"
    
      91	EOF
    
      92
    
      93	cd "${srcdir}/keeweb-native-modules"
    
      94
    
      95	npm install --ignore-scripts
    
      96
    
      97	# https://github.com/antelle/keyboard-auto-type/commit/67e917af3dcd9d78273774e7061f74d893b5523b
    
      98	patch -Np1 <"${srcdir}/67e917af3dcd9d78273774e7061f74d893b5523b.patch"
    
      99
    
      100	HOME="${srcdir}/.electron-gyp" \
    
      101	npx electron-rebuild --arch="${_arch}" --version="$(</usr/lib/${_electron}/version)" --only=argon2,keytar,usb-detection,yubikey-chalresp,keyboard-auto-type
    
      102
    
      103	cd "${srcdir}/keeweb-connect/native-messaging-host"
    
      104	make
    
      105}
    
      106
    
      107package() {
    
      108	cd "${srcdir}/${pkgname}"
    
      109
    
      110	install -Dm0755 -t "${pkgdir}/usr/bin" tmp/desktop/keeweb
    
      111	install -Dm0755 -t "${pkgdir}/usr/lib/keeweb" ../keeweb-connect/native-messaging-host/build/keeweb-native-messaging-host
    
      112	install -Dm0644 -t "${pkgdir}/usr/lib/keeweb" tmp/desktop/app.asar
    
      113	install -Dm0644 -t "${pkgdir}/usr/share/licenses/${pkgname}" LICENSE DEPS-LICENSE
    
      114	install -Dm0644 -t "${pkgdir}/usr/share/mime/packages" package/deb/usr/share/mime/packages/keeweb.xml
    
      115	install -Dm0644 -t "${pkgdir}/usr/share/applications"  package/deb/usr/share/applications/keeweb.desktop
    
      116
    
      117	install -Dm0644 graphics/128x128.png "${pkgdir}/usr/share/pixmaps/keeweb.png"
    
      118
    
      119	local _src_mdir="${srcdir}/keeweb-native-modules/node_modules"
    
      120	local _pkg_mdir="${pkgdir}/usr/lib/keeweb/node_modules/@keeweb/keeweb-native-modules"
    
      121
    
      122	install -Dm0644 "${_src_mdir}/usb-detection/build/Release/detection.node" \
    
      123		"${_pkg_mdir}/usb-detection-linux-${_arch}.node"
    
      124
    
      125	for _mod in argon2 keyboard-auto-type keytar yubikey-chalresp; do
    
      126		install -Dm0644 "${_src_mdir}/${_mod}/build/Release/${_mod}.node" \
    
      127			"${_pkg_mdir}/${_mod}-linux-${_arch}.node"
    
      128	done
    
      129}
    
      130

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2