kopuz-git

LOW

maintainer UMCEKO 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx call runs @tailwindcss/cli, which is a well-known official npm package installed locally via 'npm install' in prepare(), not fetched remotely at build time; the rest of the build compiles the project's own source from its official GitHub repo with cargo --frozen, posing no meaningful supply-chain risk beyond normal AUR packaging.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The npx call runs @tailwindcss/cli, which is a well-known official npm package installed locally via 'npm install' in prepare(), not fetched remotely at build time; the rest of the build compiles the project's own source from its official GitHub repo with cargo --frozen, posing no meaningful supply-chain risk beyond normal AUR packaging.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:61 npx @tailwindcss/cli -i ./tailwind.css -o ./crates/kopuz/assets/tailwind.css \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: temidaradev <temidaradev@proton.me>
    
      2# Contributor: umceko
    
      3pkgname=kopuz-git
    
      4pkgver=0.9.0.r2.g45515c01
    
      5pkgrel=1
    
      6pkgdesc="A modern music player (latest git, built from source)"
    
      7arch=('x86_64')
    
      8url="https://github.com/Kopuz-org/kopuz"
    
      9license=('MIT')
    
      10provides=('kopuz')
    
      11conflicts=('kopuz')
    
      12depends=(
    
      13    'webkit2gtk-4.1'
    
      14    'gtk3'
    
      15    'libsoup3'
    
      16    'glib-networking'
    
      17    'alsa-lib'
    
      18    'openssl'
    
      19    'xdotool'
    
      20    'dbus'
    
      21    'opus'
    
      22    'libayatana-appindicator'
    
      23)
    
      24makedepends=(
    
      25    'git'
    
      26    'rust'
    
      27    'nodejs'
    
      28    'npm'
    
      29    'cmake'
    
      30    'pkgconf'
    
      31)
    
      32optdepends=(
    
      33    'yt-dlp'
    
      34    'python-mutagen'
    
      35)
    
      36# makepkg's default lto option injects -flto=auto into CFLAGS; the bundled
    
      37# sqlite3.c then compiles to LTO bitcode that rustc's link of sqlx's proc-macro
    
      38# dylib silently drops, and the macro fails to load with
    
      39# "undefined symbol: sqlite3_value_type".
    
      40options=('!lto')
    
      41source=("$pkgname::git+https://github.com/Kopuz-org/kopuz.git")
    
      42sha256sums=('SKIP')
    
      43
    
      44pkgver() {
    
      45    cd "$pkgname"
    
      46    git describe --long --tags | sed 's/^v//;s/-/.r/;s/-/./'
    
      47}
    
      48
    
      49prepare() {
    
      50    cd "$pkgname"
    
      51    export RUSTUP_TOOLCHAIN=stable
    
      52    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      53    npm install
    
      54}
    
      55
    
      56build() {
    
      57    cd "$pkgname"
    
      58    export RUSTUP_TOOLCHAIN=stable
    
      59    # tailwind.css is include_str!-embedded; regenerate it from the current
    
      60    # sources like upstream's own builds do, so styling matches this checkout.
    
      61    npx @tailwindcss/cli -i ./tailwind.css -o ./crates/kopuz/assets/tailwind.css \
    
      62        --content './crates/kopuz/**/*.rs,./crates/components/**/*.rs,./crates/pages/**/*.rs,./crates/hooks/**/*.rs,./crates/player/**/*.rs,./crates/reader/**/*.rs'
    
      63    cargo build --frozen --release -p kopuz
    
      64}
    
      65
    
      66package() {
    
      67    cd "$pkgname"
    
      68
    
      69    install -Dm755 target/release/kopuz "$pkgdir/usr/bin/kopuz"
    
      70
    
      71    install -Dm644 "data/com.temidaradev.kopuz.desktop" \
    
      72        "$pkgdir/usr/share/applications/com.temidaradev.kopuz.desktop"
    
      73    sed -i "s|Exec=kopuz|Exec=/usr/bin/kopuz|" \
    
      74        "$pkgdir/usr/share/applications/com.temidaradev.kopuz.desktop"
    
      75
    
      76    install -Dm644 "crates/kopuz/assets/logo.png" \
    
      77        "$pkgdir/usr/share/icons/hicolor/256x256/apps/com.temidaradev.kopuz.png"
    
      78
    
      79    install -Dm644 "data/com.temidaradev.kopuz.metainfo.xml" \
    
      80        "$pkgdir/usr/share/metainfo/com.temidaradev.kopuz.metainfo.xml"
    
      81
    
      82    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      83}
    
      84

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2