librefang-git

LOW
maintainer wuxxin 1 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The npx command is used to run node-gyp rebuild on a locally checked-out dependency, not to execute arbitrary remote code; the source is from the project's own repository and the action is part of a standard native Node.js addon build.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command is used to run node-gyp rebuild on a locally checked-out dependency, not to execute arbitrary remote code; the source is from the project's own repository and the action is part of a standard native Node.js addon build.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:81 npx node-gyp rebuild

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Wuxxin <wuxxin@gmail.com>
2# Contributor: SteamedFish <steamedfish@hotmail.com>
3pkgbase=librefang-git
4pkgname=("librefang-git" "librefang-desktop-git" "librefang-whatsapp-gateway-git")
5pkgver=2026.10.16.r38.gb14e01642c
6pkgrel=1
7pkgdesc='LibreFang is an open-source Agent Operating System written in Rust. (GIT version)'
8arch=('x86_64' 'aarch64')
9url='https://github.com/librefang/librefang'
10license=('MIT' 'Apache-2.0')
11makedepends=('rust' 'cargo' 'git' 'webkit2gtk-4.1' 'gtk3' 'nodejs' 'npm' 'pnpm' 'node-gyp' 'nodejs-addon-api' 'libvips')
12source=(
13 "${pkgbase}::git+https://github.com/librefang/librefang.git"
14 "librefang.sysusers"
15 "librefang.tmpfiles"
16 "librefang.service"
17 "librefang-desktop.desktop"
18 "librefang-whatsapp-gateway.service"
19 "feature-local-inference.md"
20)
21sha256sums=('SKIP'
22 '72663b7a008dcf86e799df777f52c56ba700849510d3fd0c8f4a9e839702dd6e'
23 'eb06400136cd6f6e0a57f5ee802c273c3ea05b63946c60bd9e135d079d777f10'
24 'cf026330b3d4c3c708bd079b15401731e1afef4f3e780c4ad286ad0d961a6d5c'
25 'a640db0197d001c5ae9348d57cda8092e2c8170fa27ced98d5546557fadb6d17'
26 '1ddb18ffdd4c4131bf9a35debfb21a61aeda8ca1be90829e0e1b10d7bf19b975'
27 '98941a4dedfc4081d7dbb8e9ca5f3f4bc26f9e438fc3317d438863e34053e424')
28
29pkgver() {
30 cd "${pkgbase}"
31 git describe --long --tags --match 'v[0-9]*' 2>/dev/null | sed 's/^v//; s/-\(beta\|alpha\|rc\)/\1/g; s/\([^-]*-g\)/r\1/; s/-/./g' || echo "2026.7.27.r$(git rev-list --count HEAD).g$(git rev-parse --short HEAD)"
32}
33
34prepare() {
35 # Ensure HOME is writable for any git operations triggered by cargo or npm
36 mkdir -p "${srcdir}/.home"
37 export HOME="${srcdir}/.home"
38
39 cd "${pkgbase}"
40 export RUSTUP_TOOLCHAIN=stable
41 cargo fetch --target "$(rustc -vV | sed -n 's/host: //p')"
42}
43
44build() {
45 # Ensure HOME is writable for any git operations triggered by cargo or npm
46 mkdir -p "${srcdir}/.home"
47 export HOME="${srcdir}/.home"
48
49 # Build React dashboard WebUI so it gets embedded in the API binary at compile-time
50 cd "${srcdir}/${pkgbase}/crates/librefang-api/dashboard"
51 pnpm install --frozen-lockfile
52 pnpm run build
53
54 # Build Rust binaries
55 cd "${srcdir}/${pkgbase}"
56 export RUSTUP_TOOLCHAIN=stable
57 export CARGO_TARGET_DIR=target
58 # Remap source paths so binaries don't embed build-specific paths
59 export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${srcdir}=/build"
60 export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${CARGO_HOME:-${HOME}/.cargo}=/vendor"
61 export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${RUSTUP_HOME:-${HOME}/.rustup}=/rustup"
62 # Remove -flto flags due to sqlite3 GCC compatibility issues with rust-lld
63 CFLAGS="${CFLAGS//-flto=auto/}"
64 CFLAGS="${CFLAGS//-flto/}"
65 CXXFLAGS="${CXXFLAGS//-flto=auto/}"
66 CXXFLAGS="${CXXFLAGS//-flto/}"
67 export CFLAGS CXXFLAGS
68 export CARGO_PROFILE_RELEASE_LTO=false
69 cargo build --frozen --release --bin librefang --bin librefang-desktop
70
71 # Build Node.js whatsapp-gateway.
72 local _gwdir="${srcdir}/${pkgbase}/packages/whatsapp-gateway"
73 cd "${_gwdir}"
74 export GIT_CONFIG_GLOBAL="${srcdir}/.home/.gitconfig"
75 git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
76 npm install --ignore-scripts --omit=dev --legacy-peer-deps --allow-git=all
77 cp -r /usr/lib/node_modules/node-addon-api "${_gwdir}/node_modules/node-addon-api"
78
79 # Compile better-sqlite3 native addon
80 cd "${_gwdir}/node_modules/better-sqlite3"
81 npx node-gyp rebuild
82}
83
84check() {
85 export HOME="${srcdir}/.home"
86 cd "${pkgbase}"
87 export RUSTUP_TOOLCHAIN=stable
88 cargo test --frozen --release -p librefang-types --lib 2>/dev/null || true
89}
90
91package_librefang-git() {
92 pkgdesc='terminal interface and daemon for the LibreFang Agent OS'
93 depends=('glibc' 'openssl' 'libgcc' 'python')
94 optdepends=(
95 'chromium: Browser Hand support'
96 'yt-dlp: Clip Hand support'
97 'ffmpeg: Clip Hand support'
98 )
99 provides=('librefang' 'openfang')
100 conflicts=('librefang' 'openfang' 'openfang-cli' 'librefang-cli' 'librefang-cli-git')
101 replaces=('librefang-cli-git')
102 backup=('etc/librefang/env')
103
104 cd "${pkgbase}"
105 install -Dm755 "target/release/librefang" "${pkgdir}/usr/bin/librefang"
106 install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
107 install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
108 install -Dm644 "${srcdir}/feature-local-inference.md" "${pkgdir}/usr/share/doc/${pkgname}/feature-local-inference.md"
109
110 # systemd service
111 install -Dm644 "${srcdir}/librefang.service" "${pkgdir}/usr/lib/systemd/system/librefang.service"
112
113 # sysusers and tmpfiles
114 install -Dm644 "${srcdir}/librefang.sysusers" "${pkgdir}/usr/lib/sysusers.d/librefang.conf"
115 install -Dm644 "${srcdir}/librefang.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/librefang.conf"
116
117 # default environment file (empty, user-editable)
118 install -Dm644 /dev/null "${pkgdir}/etc/librefang/env"
119}
120
121package_librefang-desktop-git() {
122 pkgdesc='Desktop application for the LibreFang Agent OS'
123 depends=('glibc' 'openssl' 'libgcc' 'webkit2gtk-4.1' 'gtk3' 'glib2')
124 optdepends=(
125 'librefang-git: CLI companion tool'
126 'chromium: Browser Hand support'
127 'yt-dlp: Clip Hand support'
128 'ffmpeg: Clip Hand support'
129 )
130 provides=('librefang-desktop' 'openfang-gui' 'librefang-gui' 'librefang-gui-git')
131 conflicts=('librefang-desktop' 'openfang-gui' 'librefang-gui' 'librefang-gui-git')
132 replaces=('librefang-gui-git')
133
134 cd "${pkgbase}"
135 install -Dm755 "target/release/librefang-desktop" "${pkgdir}/usr/bin/librefang-desktop"
136 install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
137 install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
138 install -Dm644 "${srcdir}/feature-local-inference.md" \
139 "${pkgdir}/usr/share/doc/${pkgname}/feature-local-inference.md"
140
141 # .desktop file
142 install -Dm644 "${srcdir}/librefang-desktop.desktop" \
143 "${pkgdir}/usr/share/applications/librefang-desktop.desktop"
144
145 # icons
146 install -Dm644 "crates/librefang-desktop/icons/128x128.png" \
147 "${pkgdir}/usr/share/icons/hicolor/128x128/apps/librefang-desktop.png"
148 install -Dm644 "crates/librefang-desktop/icons/32x32.png" \
149 "${pkgdir}/usr/share/icons/hicolor/32x32/apps/librefang-desktop.png"
150 install -Dm644 "crates/librefang-desktop/icons/icon.png" \
151 "${pkgdir}/usr/share/icons/hicolor/512x512/apps/librefang-desktop.png"
152}
153
154package_librefang-whatsapp-gateway-git() {
155 pkgdesc='librefang WhatsApp gateway — QR login and bidirectional messaging'
156 depends=('nodejs' 'libvips' 'glibc' 'glib2' 'bash' 'libstdc++' 'libgcc')
157 optdepends=('librefang-git: connect gateway to the local librefang agent')
158 provides=('librefang-whatsapp-gateway' 'openfang-whatsapp-gateway')
159 conflicts=('librefang-whatsapp-gateway' 'openfang-whatsapp-gateway' 'librefang-whatsapp-gateway-git')
160
161 local _gatewaydir="${pkgdir}/usr/lib/librefang-whatsapp-gateway"
162
163 cd "${srcdir}/${pkgbase}/packages/whatsapp-gateway"
164
165 # Install package sources and vendored node_modules
166 install -dm755 "${_gatewaydir}"
167 cp -r index.js package.json node_modules lib "${_gatewaydir}/"
168
169 # Remove intermediate build folders/artifacts from better-sqlite3 to keep packages small
170 local _sqlitebuild="${_gatewaydir}/node_modules/better-sqlite3/build"
171 local _sqlitebin
172 _sqlitebin=$(find "${_sqlitebuild}/Release" -maxdepth 1 -name 'better_sqlite3.node' 2>/dev/null | head -1)
173 if [[ -n "${_sqlitebin}" ]]; then
174 cp "${_sqlitebin}" "${srcdir}/_better_sqlite3_tmp.node"
175 rm -rf "${_sqlitebuild}"
176 install -dm755 "${_sqlitebuild}/Release"
177 mv "${srcdir}/_better_sqlite3_tmp.node" "${_sqlitebuild}/Release/better_sqlite3.node"
178 fi
179
180 # Wrapper script
181 install -dm755 "${pkgdir}/usr/bin"
182 cat >"${pkgdir}/usr/bin/librefang-whatsapp-gateway" <<'EOF'
183#!/bin/sh
184exec node /usr/lib/librefang-whatsapp-gateway/index.js "$@"
185EOF
186 chmod 755 "${pkgdir}/usr/bin/librefang-whatsapp-gateway"
187
188 # systemd service
189 install -Dm644 "${srcdir}/librefang-whatsapp-gateway.service" \
190 "${pkgdir}/usr/lib/systemd/system/librefang-whatsapp-gateway.service"
191
192 install -Dm644 "${srcdir}/${pkgbase}/LICENSE" \
193 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
194}
195

Changes since previous scan

--- PKGBUILD @ 2026-10-27 00:23
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,13 +2,13 @@
# Contributor: SteamedFish <steamedfish@hotmail.com>
pkgbase=librefang-git
pkgname=("librefang-git" "librefang-desktop-git" "librefang-whatsapp-gateway-git")
-pkgver=2026.7.27.r13.g1b9518fd1
+pkgver=2026.10.16.r38.gb14e01642c
pkgrel=1
pkgdesc='LibreFang is an open-source Agent Operating System written in Rust. (GIT version)'
arch=('x86_64' 'aarch64')
url='https://github.com/librefang/librefang'
license=('MIT' 'Apache-2.0')
-makedepends=('rust' 'cargo' 'git' 'webkit2gtk-4.1' 'gtk3' 'nodejs' 'npm' 'pnpm' 'node-gyp' 'libvips')
+makedepends=('rust' 'cargo' 'git' 'webkit2gtk-4.1' 'gtk3' 'nodejs' 'npm' 'pnpm' 'node-gyp' 'nodejs-addon-api' 'libvips')
source=(
"${pkgbase}::git+https://github.com/librefang/librefang.git"
"librefang.sysusers"
@@ -16,13 +16,15 @@
"librefang.service"
"librefang-desktop.desktop"
"librefang-whatsapp-gateway.service"
+ "feature-local-inference.md"
)
sha256sums=('SKIP'
'72663b7a008dcf86e799df777f52c56ba700849510d3fd0c8f4a9e839702dd6e'
'eb06400136cd6f6e0a57f5ee802c273c3ea05b63946c60bd9e135d079d777f10'
'cf026330b3d4c3c708bd079b15401731e1afef4f3e780c4ad286ad0d961a6d5c'
'a640db0197d001c5ae9348d57cda8092e2c8170fa27ced98d5546557fadb6d17'
- '1ddb18ffdd4c4131bf9a35debfb21a61aeda8ca1be90829e0e1b10d7bf19b975')
+ '1ddb18ffdd4c4131bf9a35debfb21a61aeda8ca1be90829e0e1b10d7bf19b975'
+ '98941a4dedfc4081d7dbb8e9ca5f3f4bc26f9e438fc3317d438863e34053e424')
pkgver() {
cd "${pkgbase}"
@@ -30,20 +32,33 @@
}
prepare() {
+ # Ensure HOME is writable for any git operations triggered by cargo or npm
+ mkdir -p "${srcdir}/.home"
+ export HOME="${srcdir}/.home"
+
+ cd "${pkgbase}"
export RUSTUP_TOOLCHAIN=stable
- cd "${pkgbase}"
cargo fetch --target "$(rustc -vV | sed -n 's/host: //p')"
}
build() {
- # Build Rust binaries (dashboard assets are embedded at compile time via include_dir!)
+ # Ensure HOME is writable for any git operations triggered by cargo or npm
+ mkdir -p "${srcdir}/.home"
+ export HOME="${srcdir}/.home"
+
+ # Build React dashboard WebUI so it gets embedded in the API binary at compile-time
+ cd "${srcdir}/${pkgbase}/crates/librefang-api/dashboard"
+ pnpm install --frozen-lockfile
+ pnpm run build
+
+ # Build Rust binaries
cd "${srcdir}/${pkgbase}"
export RUSTUP_TOOLCHAIN=stable
export CARGO_TARGET_DIR=target
# Remap source paths so binaries don't embed build-specific paths
export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${srcdir}=/build"
export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${CARGO_HOME:-${HOME}/.cargo}=/vendor"
- export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${RUSTUP_HOME:-${HOME}.rustup}=/rustup"
+ export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${RUSTUP_HOME:-${HOME}/.rustup}=/rustup"
# Remove -flto flags due to sqlite3 GCC compatibility issues with rust-lld
CFLAGS="${CFLAGS//-flto=auto/}"
CFLAGS="${CFLAGS//-flto/}"
@@ -67,6 +82,7 @@
}
check() {
+ export HOME="${srcdir}/.home"
cd "${pkgbase}"
export RUSTUP_TOOLCHAIN=stable
cargo test --frozen --release -p librefang-types --lib 2>/dev/null || true
@@ -89,6 +105,7 @@
install -Dm755 "target/release/librefang" "${pkgdir}/usr/bin/librefang"
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
+ install -Dm644 "${srcdir}/feature-local-inference.md" "${pkgdir}/usr/share/doc/${pkgname}/feature-local-inference.md"
# systemd service
install -Dm644 "${srcdir}/librefang.service" "${pkgdir}/usr/lib/systemd/system/librefang.service"
@@ -118,6 +135,8 @@
install -Dm755 "target/release/librefang-desktop" "${pkgdir}/usr/bin/librefang-desktop"
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
+ install -Dm644 "${srcdir}/feature-local-inference.md" \
+ "${pkgdir}/usr/share/doc/${pkgname}/feature-local-inference.md"
# .desktop file
install -Dm644 "${srcdir}/librefang-desktop.desktop" \

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 21:48:49 Medium 1
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 00:06:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion