librefang-git

LOW

maintainer wuxxin 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx command is used to run node-gyp for building a native addon as part of the project's own source code during packaging; this is a legitimate build step, not execution of arbitrary remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx command is used to run node-gyp for building a native addon as part of the project's own source code during packaging; this is a legitimate build step, not execution of arbitrary remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:66 npx node-gyp rebuild

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Wuxxin <wuxxin@gmail.com>
    
      2# Contributor: SteamedFish <steamedfish@hotmail.com>
    
      3pkgbase=librefang-git
    
      4pkgname=("librefang-git" "librefang-desktop-git" "librefang-whatsapp-gateway-git")
    
      5pkgver=2026.7.27.r13.g1b9518fd1
    
      6pkgrel=1
    
      7pkgdesc='LibreFang is an open-source Agent Operating System written in Rust. (GIT version)'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://github.com/librefang/librefang'
    
      10license=('MIT' 'Apache-2.0')
    
      11makedepends=('rust' 'cargo' 'git' 'webkit2gtk-4.1' 'gtk3' 'nodejs' 'npm' 'pnpm' 'node-gyp' 'libvips')
    
      12source=(
    
      13    "${pkgbase}::git+https://github.com/librefang/librefang.git"
    
      14    "librefang.sysusers"
    
      15    "librefang.tmpfiles"
    
      16    "librefang.service"
    
      17    "librefang-desktop.desktop"
    
      18    "librefang-whatsapp-gateway.service"
    
      19)
    
      20sha256sums=('SKIP'
    
      21            '72663b7a008dcf86e799df777f52c56ba700849510d3fd0c8f4a9e839702dd6e'
    
      22            'eb06400136cd6f6e0a57f5ee802c273c3ea05b63946c60bd9e135d079d777f10'
    
      23            'cf026330b3d4c3c708bd079b15401731e1afef4f3e780c4ad286ad0d961a6d5c'
    
      24            'a640db0197d001c5ae9348d57cda8092e2c8170fa27ced98d5546557fadb6d17'
    
      25            '1ddb18ffdd4c4131bf9a35debfb21a61aeda8ca1be90829e0e1b10d7bf19b975')
    
      26
    
      27pkgver() {
    
      28    cd "${pkgbase}"
    
      29    git describe --long --tags --match 'v[0-9]*' 2>/dev/null | sed 's/^v//; s/-\(beta\|alpha\|rc\)/\1/g; s/\([^-]*-g\)/r\1/; s/-/./g' || echo "2026.7.27.r$(git rev-list --count HEAD).g$(git rev-parse --short HEAD)"
    
      30}
    
      31
    
      32prepare() {
    
      33    export RUSTUP_TOOLCHAIN=stable
    
      34    cd "${pkgbase}"
    
      35    cargo fetch --target "$(rustc -vV | sed -n 's/host: //p')"
    
      36}
    
      37
    
      38build() {
    
      39    # Build Rust binaries (dashboard assets are embedded at compile time via include_dir!)
    
      40    cd "${srcdir}/${pkgbase}"
    
      41    export RUSTUP_TOOLCHAIN=stable
    
      42    export CARGO_TARGET_DIR=target
    
      43    # Remap source paths so binaries don't embed build-specific paths
    
      44    export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${srcdir}=/build"
    
      45    export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${CARGO_HOME:-${HOME}/.cargo}=/vendor"
    
      46    export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${RUSTUP_HOME:-${HOME}.rustup}=/rustup"
    
      47    # Remove -flto flags due to sqlite3 GCC compatibility issues with rust-lld
    
      48    CFLAGS="${CFLAGS//-flto=auto/}"
    
      49    CFLAGS="${CFLAGS//-flto/}"
    
      50    CXXFLAGS="${CXXFLAGS//-flto=auto/}"
    
      51    CXXFLAGS="${CXXFLAGS//-flto/}"
    
      52    export CFLAGS CXXFLAGS
    
      53    export CARGO_PROFILE_RELEASE_LTO=false
    
      54    cargo build --frozen --release --bin librefang --bin librefang-desktop
    
      55
    
      56    # Build Node.js whatsapp-gateway.
    
      57    local _gwdir="${srcdir}/${pkgbase}/packages/whatsapp-gateway"
    
      58    cd "${_gwdir}"
    
      59    export GIT_CONFIG_GLOBAL="${srcdir}/.home/.gitconfig"
    
      60    git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
    
      61    npm install --ignore-scripts --omit=dev --legacy-peer-deps --allow-git=all
    
      62    cp -r /usr/lib/node_modules/node-addon-api "${_gwdir}/node_modules/node-addon-api"
    
      63
    
      64    # Compile better-sqlite3 native addon
    
      65    cd "${_gwdir}/node_modules/better-sqlite3"
    
      66    npx node-gyp rebuild
    
      67}
    
      68
    
      69check() {
    
      70    cd "${pkgbase}"
    
      71    export RUSTUP_TOOLCHAIN=stable
    
      72    cargo test --frozen --release -p librefang-types --lib 2>/dev/null || true
    
      73}
    
      74
    
      75package_librefang-git() {
    
      76    pkgdesc='terminal interface and daemon for the LibreFang Agent OS'
    
      77    depends=('glibc' 'openssl' 'libgcc' 'python')
    
      78    optdepends=(
    
      79        'chromium: Browser Hand support'
    
      80        'yt-dlp: Clip Hand support'
    
      81        'ffmpeg: Clip Hand support'
    
      82    )
    
      83    provides=('librefang' 'openfang')
    
      84    conflicts=('librefang' 'openfang' 'openfang-cli' 'librefang-cli' 'librefang-cli-git')
    
      85    replaces=('librefang-cli-git')
    
      86    backup=('etc/librefang/env')
    
      87
    
      88    cd "${pkgbase}"
    
      89    install -Dm755 "target/release/librefang" "${pkgdir}/usr/bin/librefang"
    
      90    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      91    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      92
    
      93    # systemd service
    
      94    install -Dm644 "${srcdir}/librefang.service" "${pkgdir}/usr/lib/systemd/system/librefang.service"
    
      95
    
      96    # sysusers and tmpfiles
    
      97    install -Dm644 "${srcdir}/librefang.sysusers" "${pkgdir}/usr/lib/sysusers.d/librefang.conf"
    
      98    install -Dm644 "${srcdir}/librefang.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/librefang.conf"
    
      99
    
      100    # default environment file (empty, user-editable)
    
      101    install -Dm644 /dev/null "${pkgdir}/etc/librefang/env"
    
      102}
    
      103
    
      104package_librefang-desktop-git() {
    
      105    pkgdesc='Desktop application for the LibreFang Agent OS'
    
      106    depends=('glibc' 'openssl' 'libgcc' 'webkit2gtk-4.1' 'gtk3' 'glib2')
    
      107    optdepends=(
    
      108        'librefang-git: CLI companion tool'
    
      109        'chromium: Browser Hand support'
    
      110        'yt-dlp: Clip Hand support'
    
      111        'ffmpeg: Clip Hand support'
    
      112    )
    
      113    provides=('librefang-desktop' 'openfang-gui' 'librefang-gui' 'librefang-gui-git')
    
      114    conflicts=('librefang-desktop' 'openfang-gui' 'librefang-gui' 'librefang-gui-git')
    
      115    replaces=('librefang-gui-git')
    
      116
    
      117    cd "${pkgbase}"
    
      118    install -Dm755 "target/release/librefang-desktop" "${pkgdir}/usr/bin/librefang-desktop"
    
      119    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      120    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      121
    
      122    # .desktop file
    
      123    install -Dm644 "${srcdir}/librefang-desktop.desktop" \
    
      124        "${pkgdir}/usr/share/applications/librefang-desktop.desktop"
    
      125
    
      126    # icons
    
      127    install -Dm644 "crates/librefang-desktop/icons/128x128.png" \
    
      128        "${pkgdir}/usr/share/icons/hicolor/128x128/apps/librefang-desktop.png"
    
      129    install -Dm644 "crates/librefang-desktop/icons/32x32.png" \
    
      130        "${pkgdir}/usr/share/icons/hicolor/32x32/apps/librefang-desktop.png"
    
      131    install -Dm644 "crates/librefang-desktop/icons/icon.png" \
    
      132        "${pkgdir}/usr/share/icons/hicolor/512x512/apps/librefang-desktop.png"
    
      133}
    
      134
    
      135package_librefang-whatsapp-gateway-git() {
    
      136    pkgdesc='librefang WhatsApp gateway — QR login and bidirectional messaging'
    
      137    depends=('nodejs' 'libvips' 'glibc' 'glib2' 'bash' 'libstdc++' 'libgcc')
    
      138    optdepends=('librefang-git: connect gateway to the local librefang agent')
    
      139    provides=('librefang-whatsapp-gateway' 'openfang-whatsapp-gateway')
    
      140    conflicts=('librefang-whatsapp-gateway' 'openfang-whatsapp-gateway' 'librefang-whatsapp-gateway-git')
    
      141
    
      142    local _gatewaydir="${pkgdir}/usr/lib/librefang-whatsapp-gateway"
    
      143
    
      144    cd "${srcdir}/${pkgbase}/packages/whatsapp-gateway"
    
      145
    
      146    # Install package sources and vendored node_modules
    
      147    install -dm755 "${_gatewaydir}"
    
      148    cp -r index.js package.json node_modules lib "${_gatewaydir}/"
    
      149
    
      150    # Remove intermediate build folders/artifacts from better-sqlite3 to keep packages small
    
      151    local _sqlitebuild="${_gatewaydir}/node_modules/better-sqlite3/build"
    
      152    local _sqlitebin
    
      153    _sqlitebin=$(find "${_sqlitebuild}/Release" -maxdepth 1 -name 'better_sqlite3.node' 2>/dev/null | head -1)
    
      154    if [[ -n "${_sqlitebin}" ]]; then
    
      155        cp "${_sqlitebin}" "${srcdir}/_better_sqlite3_tmp.node"
    
      156        rm -rf "${_sqlitebuild}"
    
      157        install -dm755 "${_sqlitebuild}/Release"
    
      158        mv "${srcdir}/_better_sqlite3_tmp.node" "${_sqlitebuild}/Release/better_sqlite3.node"
    
      159    fi
    
      160
    
      161    # Wrapper script
    
      162    install -dm755 "${pkgdir}/usr/bin"
    
      163    cat >"${pkgdir}/usr/bin/librefang-whatsapp-gateway" <<'EOF'
    
      164#!/bin/sh
    
      165exec node /usr/lib/librefang-whatsapp-gateway/index.js "$@"
    
      166EOF
    
      167    chmod 755 "${pkgdir}/usr/bin/librefang-whatsapp-gateway"
    
      168
    
      169    # systemd service
    
      170    install -Dm644 "${srcdir}/librefang-whatsapp-gateway.service" \
    
      171        "${pkgdir}/usr/lib/systemd/system/librefang-whatsapp-gateway.service"
    
      172
    
      173    install -Dm644 "${srcdir}/${pkgbase}/LICENSE" \
    
      174        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      175}
    
      176

Changes since previous scan

--- PKGBUILD @ 2026-09-11 00:19
+++ PKGBUILD @ 2026-09-17 00:27
@@ -4,11 +4,11 @@
 pkgname=("librefang-git" "librefang-desktop-git" "librefang-whatsapp-gateway-git")
 pkgver=2026.7.27.r13.g1b9518fd1
 pkgrel=1
-pkgdesc='LibreFang is an open-source Agent Operating System written in Rust. (GIT version with patches for local STT,TTS,IMAGE support) '
+pkgdesc='LibreFang is an open-source Agent Operating System written in Rust. (GIT version)'
 arch=('x86_64' 'aarch64')
 url='https://github.com/librefang/librefang'
 license=('MIT' 'Apache-2.0')
-makedepends=('rust' 'cargo' 'git' 'webkit2gtk-4.1' 'gtk3' 'libayatana-appindicator' 'nodejs' 'npm' 'pnpm' 'node-gyp' 'python' 'nodejs-addon-api' 'libvips')
+makedepends=('rust' 'cargo' 'git' 'webkit2gtk-4.1' 'gtk3' 'nodejs' 'npm' 'pnpm' 'node-gyp' 'libvips')
 source=(
     "${pkgbase}::git+https://github.com/librefang/librefang.git"
     "librefang.sysusers"
@@ -16,62 +16,34 @@
     "librefang.service"
     "librefang-desktop.desktop"
     "librefang-whatsapp-gateway.service"
-    "feature-local-stt.patch"
-    "feature-local-tts.patch"
-    "feature-local-image.patch"
-    "feature-local-inference.md"
 )
 sha256sums=('SKIP'
             '72663b7a008dcf86e799df777f52c56ba700849510d3fd0c8f4a9e839702dd6e'
             'eb06400136cd6f6e0a57f5ee802c273c3ea05b63946c60bd9e135d079d777f10'
             'cf026330b3d4c3c708bd079b15401731e1afef4f3e780c4ad286ad0d961a6d5c'
             'a640db0197d001c5ae9348d57cda8092e2c8170fa27ced98d5546557fadb6d17'
-            '1ddb18ffdd4c4131bf9a35debfb21a61aeda8ca1be90829e0e1b10d7bf19b975'
-            'aa2df1c379d02a52bf4072f3de2f6c3be0512fc3efcbb141320ba19d8fc3ca46'
-            'c4fccf730140e3cbe1c694b6f4f3b94c47b998ba76262ce50c63f578822d5918'
-            '673dc14c22aa89457a2e1684bf075b7e0ae5ecc520830529b6edcfac1e68246b'
-            '6fa3cb22d68b37cdc9605cc5c02c9095ea4ce47466e415c01dc54c7f7e81bb6a')
+            '1ddb18ffdd4c4131bf9a35debfb21a61aeda8ca1be90829e0e1b10d7bf19b975')
 
 pkgver() {
     cd "${pkgbase}"
-    git describe --long --tags --match 'v[0-9]*' | sed 's/^v//; s/-\(beta\|alpha\|rc\)/\1/g; s/\([^-]*-g\)/r\1/; s/-/./g'
+    git describe --long --tags --match 'v[0-9]*' 2>/dev/null | sed 's/^v//; s/-\(beta\|alpha\|rc\)/\1/g; s/\([^-]*-g\)/r\1/; s/-/./g' || echo "2026.7.27.r$(git rev-list --count HEAD).g$(git rev-parse --short HEAD)"
 }
 
 prepare() {
-    # Ensure HOME is writable for any git operations triggered by cargo or npm
-    mkdir -p "${srcdir}/.home"
-    export HOME="${srcdir}/.home"
-
+    export RUSTUP_TOOLCHAIN=stable
     cd "${pkgbase}"
-
-    # Apply local patches
-    msg2 "Applying local STT, TTS and image support patches..."
-    patch -Np1 -i "${srcdir}/feature-local-stt.patch"
-    patch -Np1 -i "${srcdir}/feature-local-tts.patch"
-    patch -Np1 -i "${srcdir}/feature-local-image.patch"
-
-    export RUSTUP_TOOLCHAIN=stable
     cargo fetch --target "$(rustc -vV | sed -n 's/host: //p')"
 }
 
 build() {
-    # Ensure HOME is writable for any git operations triggered by cargo or npm
-    mkdir -p "${srcdir}/.home"
-    export HOME="${srcdir}/.home"
-
-    # Build React dashboard WebUI so it gets embedded in the API binary at compile-time
-    cd "${srcdir}/${pkgbase}/crates/librefang-api/dashboard"
-    pnpm install --frozen-lockfile
-    pnpm run build
-
-    # Build Rust binaries
+    # Build Rust binaries (dashboard assets are embedded at compile time via include_dir!)
     cd "${srcdir}/${pkgbase}"
     export RUSTUP_TOOLCHAIN=stable
     export CARGO_TARGET_DIR=target
     # Remap source paths so binaries don't embed build-specific paths
     export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${srcdir}=/build"
     export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${CARGO_HOME:-${HOME}/.cargo}=/vendor"
-    export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${RUSTUP_HOME:-${HOME}/.rustup}=/rustup"
+    export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${RUSTUP_HOME:-${HOME}.rustup}=/rustup"
     # Remove -flto flags due to sqlite3 GCC compatibility issues with rust-lld
     CFLAGS="${CFLAGS//-flto=auto/}"
     CFLAGS="${CFLAGS//-flto/}"
@@ -82,25 +54,16 @@
     cargo build --frozen --release --bin librefang --bin librefang-desktop
 
     # Build Node.js whatsapp-gateway.
-    # baileys depends on libsignal from git. npm >= 12 defaults allow-git to
-    # "none" and refuses to fetch it; --allow-git=root is not enough because
-    # libsignal is transitive, not in the gateway's own package.json. The
-    # lockfile also resolves it over ssh, which has no credentials here, so
-    # rewrite ssh to https (HOME is confined to ${srcdir}/.home above).
     local _gwdir="${srcdir}/${pkgbase}/packages/whatsapp-gateway"
     cd "${_gwdir}"
-    # makepkg pins GIT_CONFIG_GLOBAL to /dev/null, so redirect it at a writable
-    # path before configuring the rewrite.
     export GIT_CONFIG_GLOBAL="${srcdir}/.home/.gitconfig"
     git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
     npm install --ignore-scripts --omit=dev --legacy-peer-deps --allow-git=all
-    # Copy system node-addon-api for compiling sharp/better-sqlite3 if needed
     cp -r /usr/lib/node_modules/node-addon-api "${_gwdir}/node_modules/node-addon-api"
 
     # Compile better-sqlite3 native addon
     cd "${_gwdir}/node_modules/better-sqlite3"
     npx node-gyp rebuild
-
 }
 
 check() {
@@ -111,7 +74,7 @@
 
 package_librefang-git() {
     pkgdesc='terminal interface and daemon for the LibreFang Agent OS'
-    depends=('glibc' 'openssl' 'libgcc' 'python-librefang-sdk-git')
+    depends=('glibc' 'openssl' 'libgcc' 'python')
     optdepends=(
         'chromium: Browser Hand support'
         'yt-dlp: Clip Hand support'
@@ -126,7 +89,6 @@
     install -Dm755 "target/release/librefang" "${pkgdir}/usr/bin/librefang"
     install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
     install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
-    install -Dm644 "${srcdir}/feature-local-inference.md" "${pkgdir}/usr/share/doc/${pkgname}/feature-local-inference.md"
 
     # systemd service
     install -Dm644 "${srcdir}/librefang.service" "${pkgdir}/usr/lib/systemd/system/librefang.service"
@@ -141,7 +103,7 @@
 
 package_librefang-desktop-git() {
     pkgdesc='Desktop application for the LibreFang Agent OS'
-    depends=('glibc' 'openssl' 'libgcc' 'webkit2gtk-4.1' 'gtk3' 'cairo' 'gdk-pixbuf2' 'glib2' 'libsoup3' 'hicolor-icon-theme' 'python-librefang-sdk-git')
+    depends=('glibc' 'openssl' 'libgcc' 'webkit2gtk-4.1' 'gtk3' 'glib2')
     optdepends=(
         'librefang-git: CLI companion tool'
         'chromium: Browser Hand support'
@@ -156,8 +118,6 @@
     install -Dm755 "target/release/librefang-desktop" "${pkgdir}/usr/bin/librefang-desktop"
     install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
     install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
-    install -Dm644 "${srcdir}/feature-local-inference.md" \
-        "${pkgdir}/usr/share/doc/${pkgname}/feature-local-inference.md"
 
     # .desktop file
     install -Dm644 "${srcdir}/librefang-desktop.desktop" \
@@ -187,7 +147,7 @@
     install -dm755 "${_gatewaydir}"
     cp -r index.js package.json node_modules lib "${_gatewaydir}/"
 
-    # Remove intermediate build folders/artifacts from better-sqlite3 and sharp to keep packages small
+    # Remove intermediate build folders/artifacts from better-sqlite3 to keep packages small
     local _sqlitebuild="${_gatewaydir}/node_modules/better-sqlite3/build"
     local _sqlitebin
     _sqlitebin=$(find "${_sqlitebuild}/Release" -maxdepth 1 -name 'better_sqlite3.node' 2>/dev/null | head -1)

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 13:22:32	Medium	1
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2