leavepad

LOW
maintainer zxp19821005 0 votes scanned 2026-10-29 03:51:44.591871
View on AUR
Why flagged

The package installs a versioned pnpm from npm using a dynamically determined version, but this occurs in a controlled build environment and is part of normal JavaScript project tooling setup, not an untrusted external package.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs a versioned pnpm from npm using a dynamically determined version, but this occurs in a controlled build environment and is part of normal JavaScript project tooling setup, not an untrusted external package.

  • PKGBUILD:87 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=leavepad
3_pkgname=Leavepad
4pkgver=2.9.3
5_electronversion=45
6_nodeversion=24
7pkgrel=1
8pkgdesc="A simple note-taking app with integrated file editor, built with Electron and Monaco Editor."
9arch=('any')
10url="https://github.com/kaishuu0123/leavepad"
11license=('MIT')
12depends=(
13 "electron${_electronversion}"
14)
15makedepends=(
16 'npm'
17 'pnpm'
18 'git'
19 'nvm'
20 'gendesk'
21 'jq'
22)
23source=(
24 "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
25 "${pkgname}.js"
26 "${pkgname}.sh"
27)
28sha256sums=('c79c8bb1769ae519b7e11bde049e05ec44a74e65b00a7fc49ec988f6d269c69a'
29 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
30 '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
31_get_project_dir() {
32 local d
33 while IFS= read -r d; do
34 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
35 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
36}
37_ensure_local_nvm() {
38 local NVM_DIR="${srcdir}/.nvm"
39 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
40 nvm install "${_nodeversion}"
41 nvm use "${_nodeversion}"
42}
43_get_app_dir() {
44 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
45 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
46}
47_get_electron_version() {
48 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
49 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
50 | grep -oE '[0-9]+' | head -1)
51 [[ -z "${_elec_ver}" ]] && return 1
52 (( _elec_ver == _electronversion )) && c=32 || c=31
53 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
54}
55_set_build_env() {
56 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
57 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
58 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
59 export ELECTRON_BUILDER_OFFLINE=true
60 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
61 export HOME="${srcdir}/.home"
62 export XDG_CACHE_HOME="${HOME}/.cache"
63 export XDG_CONFIG_HOME="${HOME}/.config"
64 export XDG_DATA_HOME="${HOME}/.local/share"
65 export XDG_STATE_HOME="${HOME}/.local/state"
66 export PNPM_HOME="${HOME}/.pnpm/bin"
67 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
68 export pnpm_config_store_dir="${HOME}/.pnpm_store"
69 export pnpm_config_global_dir="${HOME}/.pnpm/global"
70 export pnpm_config_state_dir="${HOME}/.pnpm/state"
71 export pnpm_config_node_linker=hoisted
72 export pnpm_config_minimum_release_age=0
73 export pnpm_config_update_notifier=false
74 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
75 export COREPACK_HOME="${HOME}/.corepack"
76 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
77 export PATH="${PNPM_HOME}:${PATH}"
78 local _pnpmver=""
79 local _pkgjson="$(_get_project_dir)/package.json"
80 if [ -f "${_pkgjson}" ]; then
81 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
82 if [ -z "${_pnpmver}" ]; then
83 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
84 fi
85 fi
86 if [ -n "${_pnpmver}" ]; then
87 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
88 --registry "${COREPACK_NPM_REGISTRY}"
89 fi
90}
91prepare() {
92 cd "$(_get_project_dir)"
93 _get_electron_version
94 sed -i -e "
95 s/@electronversion@/${_electronversion}/g
96 s/@appname@/${pkgname}/g
97 " "${srcdir}/${pkgname}.sh" "${srcdir}/${pkgname}.js"
98 gendesk -q -f -n \
99 --pkgname="${pkgname}" \
100 --pkgdesc="${pkgdesc}" \
101 --categories="Utility" \
102 --name="${_pkgname}" \
103 --exec="${pkgname} %U"
104 _ensure_local_nvm
105 _set_build_env
106 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
107 export NODE_ENV=development
108 pnpm install
109}
110build() {
111 cd "$(_get_project_dir)"
112 _ensure_local_nvm
113 _set_build_env
114 export NODE_ENV=production
115 pnpm run build:vite
116 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
117 rm -rf "$(_get_app_dir)/resources/default_app.asar"
118}
119package() {
120 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
121 install -Dm644 "${srcdir}/${pkgname}.js" -t "${pkgdir}/usr/lib/${pkgname}"
122 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
123 install -Dm644 "$(_get_project_dir)/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
124 install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
125 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
126}
127

Changes since previous scan

--- PKGBUILD @ 2026-09-22 05:36
+++ PKGBUILD @ 2026-10-29 03:51
@@ -1,8 +1,8 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=leavepad
_pkgname=Leavepad
-pkgver=2.8.0
-_electronversion=43
+pkgver=2.9.3
+_electronversion=45
_nodeversion=24
pkgrel=1
pkgdesc="A simple note-taking app with integrated file editor, built with Electron and Monaco Editor."
@@ -14,24 +14,43 @@
)
makedepends=(
'npm'
- 'yarn'
+ 'pnpm'
'git'
'nvm'
- 'curl'
'gendesk'
'jq'
)
source=(
- "${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}"
+ "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
+ "${pkgname}.js"
"${pkgname}.sh"
)
-sha256sums=('bb7716e3caf105dc18b35a41f25fca23583862a470f86924ad7288ae011837b2'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+sha256sums=('c79c8bb1769ae519b7e11bde049e05ec44a74e65b00a7fc49ec988f6d269c69a'
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
+}
+_get_app_dir() {
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
+}
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
@@ -43,66 +62,39 @@
export XDG_CACHE_HOME="${HOME}/.cache"
export XDG_CONFIG_HOME="${HOME}/.config"
export XDG_DATA_HOME="${HOME}/.local/share"
- export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
- export YARN_NETWORK_CONCURRENCY=32
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
export COREPACK_HOME="${HOME}/.corepack"
- export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
- local _yarnver _yarnmajor=0
- _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
- _yarnmajor="${_yarnver%%.*}"
- _yarnmajor="${_yarnmajor:-0}"
- if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
- export XDG_STATE_HOME="${HOME}/.local/state"
- export YARN_ENABLE_GLOBAL_CACHE=false
- export YARN_ENABLE_MIRROR=false
- export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
- export YARN_NODE_LINKER=node-modules
- export YARN_NM_MODE=hardlinks-local
- export YARN_ENABLE_TELEMETRY=false
- export YARN_ENABLE_SCRIPTS=true
- export YARN_HTTP_TIMEOUT=600000
- export YARN_HTTP_RETRY=5
- export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
- mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}"
- else
- export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
- export YARN_LINK_FOLDER="${HOME}/.yarn/link"
- export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
- export YARN_NETWORK_TIMEOUT=600000
- export YARN_CHILD_CONCURRENCY="$(nproc)"
- export YARN_FROZEN_LOCKFILE=true
- export YARN_IGNORE_ENGINES=true
- export YARN_PRODUCTION=false
- mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
fi
- local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
- _reg="${_reg%/}"
- if [[ -f .yarnrc ]]; then
- sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
- fi
- if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
- sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
fi
}
-_get_app_dir() {
- find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
-}
-_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
-}
prepare() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${pkgname}/g
- " "${srcdir}/${pkgname}.sh"
+ " "${srcdir}/${pkgname}.sh" "${srcdir}/${pkgname}.js"
gendesk -q -f -n \
--pkgname="${pkgname}" \
--pkgdesc="${pkgdesc}" \
@@ -111,26 +103,25 @@
--exec="${pkgname} %U"
_ensure_local_nvm
_set_build_env
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
export NODE_ENV=development
- yarn install
+ pnpm install
}
build() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
_ensure_local_nvm
_set_build_env
export NODE_ENV=production
- yarn run build
- yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
+ pnpm run build:vite
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
- install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
- rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${srcdir}/${pkgname}.js" -t "${pkgdir}/usr/lib/${pkgname}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
+ install -Dm644 "$(_get_project_dir)/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
+ install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-10-29 03:51:44 Low 1
2026-09-22 05:36:56 Clean 0
2026-07-27 05:34:42 Clean 0
2026-07-27 03:34:02 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion