librefang-whatsapp-gateway-git

maintainer wuxxin · 1 votes · base librefang-git · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx execution is used to rebuild a native addon (better-sqlite3) from source within a vendored node_modules directory as part of the build process; it does not execute arbitrary remote code or introduce a supply-chain risk beyond normal dependency compilation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx execution is used to rebuild a native addon (better-sqlite3) from source within a vendored node_modules directory as part of the build process; it does not execute arbitrary remote code or introduce a supply-chain risk beyond normal dependency compilation.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:102 npx node-gyp rebuild

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Wuxxin <wuxxin@gmail.com>
    
      2# Contributor: SteamedFish <steamedfish@hotmail.com>
    
      3pkgbase=librefang-git
    
      4pkgname=("librefang-git" "librefang-desktop-git" "librefang-whatsapp-gateway-git")
    
      5pkgver=2026.7.27.r13.g1b9518fd1
    
      6pkgrel=1
    
      7pkgdesc='LibreFang is an open-source Agent Operating System written in Rust. (GIT version with patches for local STT,TTS,IMAGE support) '
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://github.com/librefang/librefang'
    
      10license=('MIT' 'Apache-2.0')
    
      11makedepends=('rust' 'cargo' 'git' 'webkit2gtk-4.1' 'gtk3' 'libayatana-appindicator' 'nodejs' 'npm' 'pnpm' 'node-gyp' 'python' 'nodejs-addon-api' 'libvips')
    
      12source=(
    
  "${pkgbase}::git+https://github.com/librefang/librefang.git"
    
  "librefang.sysusers"
    
  "librefang.tmpfiles"
    
  "librefang.service"
    
  "librefang-desktop.desktop"
    
  "librefang-whatsapp-gateway.service"
    
  "feature-local-stt.patch"
    
  "feature-local-tts.patch"
    
  "feature-local-image.patch"
    
  "feature-local-inference.md"
    
      23)
    
      24sha256sums=('SKIP'
    
          '72663b7a008dcf86e799df777f52c56ba700849510d3fd0c8f4a9e839702dd6e'
    
          'eb06400136cd6f6e0a57f5ee802c273c3ea05b63946c60bd9e135d079d777f10'
    
          'cf026330b3d4c3c708bd079b15401731e1afef4f3e780c4ad286ad0d961a6d5c'
    
          'a640db0197d001c5ae9348d57cda8092e2c8170fa27ced98d5546557fadb6d17'
    
          '1ddb18ffdd4c4131bf9a35debfb21a61aeda8ca1be90829e0e1b10d7bf19b975'
    
          'aa2df1c379d02a52bf4072f3de2f6c3be0512fc3efcbb141320ba19d8fc3ca46'
    
          'c4fccf730140e3cbe1c694b6f4f3b94c47b998ba76262ce50c63f578822d5918'
    
          '673dc14c22aa89457a2e1684bf075b7e0ae5ecc520830529b6edcfac1e68246b'
    
          '6fa3cb22d68b37cdc9605cc5c02c9095ea4ce47466e415c01dc54c7f7e81bb6a')
    
      34
    
      35pkgver() {
    
  cd "${pkgbase}"
    
  git describe --long --tags --match 'v[0-9]*' | sed 's/^v//; s/-\(beta\|alpha\|rc\)/\1/g; s/\([^-]*-g\)/r\1/; s/-/./g'
    
      38}
    
      39
    
      40prepare() {
    
  # Ensure HOME is writable for any git operations triggered by cargo or npm
    
  mkdir -p "${srcdir}/.home"
    
  export HOME="${srcdir}/.home"
    
      44
    
  cd "${pkgbase}"
    
      46
    
  # Apply local patches
    
  msg2 "Applying local STT, TTS and image support patches..."
    
  patch -Np1 -i "${srcdir}/feature-local-stt.patch"
    
  patch -Np1 -i "${srcdir}/feature-local-tts.patch"
    
  patch -Np1 -i "${srcdir}/feature-local-image.patch"
    
      52
    
  export RUSTUP_TOOLCHAIN=stable
    
  cargo fetch --target "$(rustc -vV | sed -n 's/host: //p')"
    
      55}
    
      56
    
      57build() {
    
  # Ensure HOME is writable for any git operations triggered by cargo or npm
    
  mkdir -p "${srcdir}/.home"
    
  export HOME="${srcdir}/.home"
    
      61
    
  # Build React dashboard WebUI so it gets embedded in the API binary at compile-time
    
  cd "${srcdir}/${pkgbase}/crates/librefang-api/dashboard"
    
  pnpm install --frozen-lockfile
    
  pnpm run build
    
      66
    
  # Build Rust binaries
    
  cd "${srcdir}/${pkgbase}"
    
  export RUSTUP_TOOLCHAIN=stable
    
  export CARGO_TARGET_DIR=target
    
  # Remap source paths so binaries don't embed build-specific paths
    
  export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${srcdir}=/build"
    
  export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${CARGO_HOME:-${HOME}/.cargo}=/vendor"
    
  export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${RUSTUP_HOME:-${HOME}/.rustup}=/rustup"
    
  # Remove -flto flags due to sqlite3 GCC compatibility issues with rust-lld
    
  CFLAGS="${CFLAGS//-flto=auto/}"
    
  CFLAGS="${CFLAGS//-flto/}"
    
  CXXFLAGS="${CXXFLAGS//-flto=auto/}"
    
  CXXFLAGS="${CXXFLAGS//-flto/}"
    
  export CFLAGS CXXFLAGS
    
  export CARGO_PROFILE_RELEASE_LTO=false
    
  cargo build --frozen --release --bin librefang --bin librefang-desktop
    
      83
    
  # Build Node.js whatsapp-gateway.
    
  # baileys depends on libsignal from git. npm >= 12 defaults allow-git to
    
  # "none" and refuses to fetch it; --allow-git=root is not enough because
    
  # libsignal is transitive, not in the gateway's own package.json. The
    
  # lockfile also resolves it over ssh, which has no credentials here, so
    
  # rewrite ssh to https (HOME is confined to ${srcdir}/.home above).
    
  local _gwdir="${srcdir}/${pkgbase}/packages/whatsapp-gateway"
    
  cd "${_gwdir}"
    
  # makepkg pins GIT_CONFIG_GLOBAL to /dev/null, so redirect it at a writable
    
  # path before configuring the rewrite.
    
  export GIT_CONFIG_GLOBAL="${srcdir}/.home/.gitconfig"
    
  git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
    
  npm install --ignore-scripts --omit=dev --legacy-peer-deps --allow-git=all
    
  # Copy system node-addon-api for compiling sharp/better-sqlite3 if needed
    
  cp -r /usr/lib/node_modules/node-addon-api "${_gwdir}/node_modules/node-addon-api"
    
      99
    
  # Compile better-sqlite3 native addon
    
  cd "${_gwdir}/node_modules/better-sqlite3"
    
  npx node-gyp rebuild
    
      103
    
      104}
    
      105
    
      106check() {
    
  cd "${pkgbase}"
    
  export RUSTUP_TOOLCHAIN=stable
    
  cargo test --frozen --release -p librefang-types --lib 2>/dev/null || true
    
      110}
    
      111
    
      112package_librefang-git() {
    
  pkgdesc='terminal interface and daemon for the LibreFang Agent OS'
    
  depends=('glibc' 'openssl' 'libgcc' 'python-librefang-sdk-git')
    
  optdepends=(
    
      'chromium: Browser Hand support'
    
      'yt-dlp: Clip Hand support'
    
      'ffmpeg: Clip Hand support'
    
  )
    
  provides=('librefang' 'openfang')
    
  conflicts=('librefang' 'openfang' 'openfang-cli' 'librefang-cli' 'librefang-cli-git')
    
  replaces=('librefang-cli-git')
    
  backup=('etc/librefang/env')
    
      124
    
  cd "${pkgbase}"
    
  install -Dm755 "target/release/librefang" "${pkgdir}/usr/bin/librefang"
    
  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
  install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
  install -Dm644 "${srcdir}/feature-local-inference.md" "${pkgdir}/usr/share/doc/${pkgname}/feature-local-inference.md"
    
      130
    
  # systemd service
    
  install -Dm644 "${srcdir}/librefang.service" "${pkgdir}/usr/lib/systemd/system/librefang.service"
    
      133
    
  # sysusers and tmpfiles
    
  install -Dm644 "${srcdir}/librefang.sysusers" "${pkgdir}/usr/lib/sysusers.d/librefang.conf"
    
  install -Dm644 "${srcdir}/librefang.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/librefang.conf"
    
      137
    
  # default environment file (empty, user-editable)
    
  install -Dm644 /dev/null "${pkgdir}/etc/librefang/env"
    
      140}
    
      141
    
      142package_librefang-desktop-git() {
    
  pkgdesc='Desktop application for the LibreFang Agent OS'
    
  depends=('glibc' 'openssl' 'libgcc' 'webkit2gtk-4.1' 'gtk3' 'cairo' 'gdk-pixbuf2' 'glib2' 'libsoup3' 'hicolor-icon-theme' 'python-librefang-sdk-git')
    
  optdepends=(
    
      'librefang-git: CLI companion tool'
    
      'chromium: Browser Hand support'
    
      'yt-dlp: Clip Hand support'
    
      'ffmpeg: Clip Hand support'
    
  )
    
  provides=('librefang-desktop' 'openfang-gui' 'librefang-gui' 'librefang-gui-git')
    
  conflicts=('librefang-desktop' 'openfang-gui' 'librefang-gui' 'librefang-gui-git')
    
  replaces=('librefang-gui-git')
    
      154
    
  cd "${pkgbase}"
    
  install -Dm755 "target/release/librefang-desktop" "${pkgdir}/usr/bin/librefang-desktop"
    
  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
  install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
  install -Dm644 "${srcdir}/feature-local-inference.md" \
    
      "${pkgdir}/usr/share/doc/${pkgname}/feature-local-inference.md"
    
      161
    
  # .desktop file
    
  install -Dm644 "${srcdir}/librefang-desktop.desktop" \
    
      "${pkgdir}/usr/share/applications/librefang-desktop.desktop"
    
      165
    
  # icons
    
  install -Dm644 "crates/librefang-desktop/icons/128x128.png" \
    
      "${pkgdir}/usr/share/icons/hicolor/128x128/apps/librefang-desktop.png"
    
  install -Dm644 "crates/librefang-desktop/icons/32x32.png" \
    
      "${pkgdir}/usr/share/icons/hicolor/32x32/apps/librefang-desktop.png"
    
  install -Dm644 "crates/librefang-desktop/icons/icon.png" \
    
      "${pkgdir}/usr/share/icons/hicolor/512x512/apps/librefang-desktop.png"
    
      173}
    
      174
    
      175package_librefang-whatsapp-gateway-git() {
    
  pkgdesc='librefang WhatsApp gateway — QR login and bidirectional messaging'
    
  depends=('nodejs' 'libvips' 'glibc' 'glib2' 'bash' 'libstdc++' 'libgcc')
    
  optdepends=('librefang-git: connect gateway to the local librefang agent')
    
  provides=('librefang-whatsapp-gateway' 'openfang-whatsapp-gateway')
    
  conflicts=('librefang-whatsapp-gateway' 'openfang-whatsapp-gateway' 'librefang-whatsapp-gateway-git')
    
      181
    
  local _gatewaydir="${pkgdir}/usr/lib/librefang-whatsapp-gateway"
    
      183
    
  cd "${srcdir}/${pkgbase}/packages/whatsapp-gateway"
    
      185
    
  # Install package sources and vendored node_modules
    
  install -dm755 "${_gatewaydir}"
    
  cp -r index.js package.json node_modules lib "${_gatewaydir}/"
    
      189
    
  # Remove intermediate build folders/artifacts from better-sqlite3 and sharp to keep packages small
    
  local _sqlitebuild="${_gatewaydir}/node_modules/better-sqlite3/build"
    
  local _sqlitebin
    
  _sqlitebin=$(find "${_sqlitebuild}/Release" -maxdepth 1 -name 'better_sqlite3.node' 2>/dev/null | head -1)
    
  if [[ -n "${_sqlitebin}" ]]; then
    
      cp "${_sqlitebin}" "${srcdir}/_better_sqlite3_tmp.node"
    
      rm -rf "${_sqlitebuild}"
    
      install -dm755 "${_sqlitebuild}/Release"
    
      mv "${srcdir}/_better_sqlite3_tmp.node" "${_sqlitebuild}/Release/better_sqlite3.node"
    
  fi
    
      200
    
  # Wrapper script
    
  install -dm755 "${pkgdir}/usr/bin"
    
  cat >"${pkgdir}/usr/bin/librefang-whatsapp-gateway" <<'EOF'
    
      204#!/bin/sh
    
      205exec node /usr/lib/librefang-whatsapp-gateway/index.js "$@"
    
      206EOF
    
  chmod 755 "${pkgdir}/usr/bin/librefang-whatsapp-gateway"
    
      208
    
  # systemd service
    
  install -Dm644 "${srcdir}/librefang-whatsapp-gateway.service" \
    
      "${pkgdir}/usr/lib/systemd/system/librefang-whatsapp-gateway.service"
    
      212
    
  install -Dm644 "${srcdir}/${pkgbase}/LICENSE" \
    
      "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      215}
    
      216

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 # Contributor: SteamedFish <steamedfish@hotmail.com>
 pkgbase=librefang-git
 pkgname=("librefang-git" "librefang-desktop-git" "librefang-whatsapp-gateway-git")
-pkgver=2026.6.29.r9.g83ee2627b
+pkgver=2026.7.27.r13.g1b9518fd1
 pkgrel=1
 pkgdesc='LibreFang is an open-source Agent Operating System written in Rust. (GIT version with patches for local STT,TTS,IMAGE support) '
 arch=('x86_64' 'aarch64')
@@ -27,9 +27,9 @@
             'cf026330b3d4c3c708bd079b15401731e1afef4f3e780c4ad286ad0d961a6d5c'
             'a640db0197d001c5ae9348d57cda8092e2c8170fa27ced98d5546557fadb6d17'
             '1ddb18ffdd4c4131bf9a35debfb21a61aeda8ca1be90829e0e1b10d7bf19b975'
-            '0e4ccc9ec9d34b0c765f1fac33a8e22949ef19fc05148fe18c1dad78718dcbc4'
-            '8d8e5722dcdbe7821e9375018076cebfcc5d30a7b8e646623714190dd0d1383e'
-            '6226943a917e31ea998fdf9626a8d67aff17541491b62c58ce12c4f679c6d187'
+            'aa2df1c379d02a52bf4072f3de2f6c3be0512fc3efcbb141320ba19d8fc3ca46'
+            'c4fccf730140e3cbe1c694b6f4f3b94c47b998ba76262ce50c63f578822d5918'
+            '673dc14c22aa89457a2e1684bf075b7e0ae5ecc520830529b6edcfac1e68246b'
             '6fa3cb22d68b37cdc9605cc5c02c9095ea4ce47466e415c01dc54c7f7e81bb6a')
 
 pkgver() {
@@ -81,10 +81,19 @@
     export CARGO_PROFILE_RELEASE_LTO=false
     cargo build --frozen --release --bin librefang --bin librefang-desktop
 
-    # Build Node.js whatsapp-gateway
+    # Build Node.js whatsapp-gateway.
+    # baileys depends on libsignal from git. npm >= 12 defaults allow-git to
+    # "none" and refuses to fetch it; --allow-git=root is not enough because
+    # libsignal is transitive, not in the gateway's own package.json. The
+    # lockfile also resolves it over ssh, which has no credentials here, so
+    # rewrite ssh to https (HOME is confined to ${srcdir}/.home above).
     local _gwdir="${srcdir}/${pkgbase}/packages/whatsapp-gateway"
     cd "${_gwdir}"
-    npm install --ignore-scripts --omit=dev --legacy-peer-deps
+    # makepkg pins GIT_CONFIG_GLOBAL to /dev/null, so redirect it at a writable
+    # path before configuring the rewrite.
+    export GIT_CONFIG_GLOBAL="${srcdir}/.home/.gitconfig"
+    git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
+    npm install --ignore-scripts --omit=dev --legacy-peer-deps --allow-git=all
     # Copy system node-addon-api for compiling sharp/better-sqlite3 if needed
     cp -r /usr/lib/node_modules/node-addon-api "${_gwdir}/node_modules/node-addon-api"
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 13:11:48	MEDIUM	1
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2