linkandroid-git

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a public GitHub repository and uses a Chinese npm mirror for dependencies, which is a common practice in China to improve download speeds; the mirror is not inherently malicious, and the source code is openly auditable.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a public GitHub repository and uses a Chinese npm mirror for dependencies, which is a common practice in China to improve download speeds; the mirror is not inherently malicious, and the source code is openly auditable.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Package install from an untrusted index/registry host install_untrusted_index

An install command is pointed at a custom package index / registry on a non-allowlisted host (--index-url / --registry / --extra-index-url), a classic dependency-confusion vector.

PKGBUILD:45 npm config set registry https://registry.npmmirror.com

PKGBUILD

1 offending line(s) highlighted

      1# Contributor MYT1 <MYT1 @ YAHOO.com>
    
      2
    
      3pkgname=linkandroid-git
    
      4_pkgname=LinkAndroid
    
      5pkgdesc="Easily project Android screen to PC"
    
      6pkgver=20241223.0706be2
    
      7pkgrel=1
    
      8arch=('x86_64' 'arm64')
    
      9url=https://linkandroid.com/
    
      10licence=(GPL-3.0)
    
      11depends=('hicolor-icon-theme'
    
      12    'gtk3'
    
      13    'libnotify'
    
      14    'nss'
    
      15    'libxss'
    
      16    'libxtst'
    
      17    'xdg-utils'
    
      18    'at-spi2-core'
    
      19    'util-linux-libs'
    
      20    'libsecret'
    
      21    'libappindicator-gtk3'
    
      22    "electron${_electronversion}"
    
      23    "ffmpeg")
    
      24makedepends=('asar'
    
      25    'npm'
    
      26    'nvm'
    
      27    'pnpm'
    
      28)
    
      29conflicts=("${pkgname%-git}"
    
      30    "${pkgname%-git}-bin"
    
      31)
    
      32source=("git+https://github.com/modstart-lib/linkandroid.git")
    
      33sha256sums=('SKIP')
    
      34_electronversion=33
    
      35_nodeversion=23
    
      36
    
      37pkgver(){
    
      38    cd "${srcdir}/${pkgname%-git}"
    
      39
    
      40    # Commit date + short rev
    
      41    echo $(TZ=UTC git show -s --pretty=%cd --date=format-local:%Y%m%d HEAD).$(git rev-parse --short HEAD)
    
      42}
    
      43
    
      44prepare(){
    
      45    npm config set registry https://registry.npmmirror.com
    
      46    git -C "${srcdir}/${pkgname%-git}" clean -dfx
    
      47
    
      48	cd "${srcdir}/${pkgname%-git}"
    
      49	npm install
    
      50}
    
      51
    
      52build(){
    
      53	cd "${srcdir}/${pkgname%-git}"
    
      54	gendesk -q -f -n --pkgname="${pkgname%-git}" --pkgdesc="${pkgdesc}" --categories="Utility" --name="${_pkgname}" --exec="${pkgname%-git} %U" --comment="Link android to PC easily" --icon="${pkgname%-git}"
    
      55	sed -i '114,120d' electron-builder.json5
    
      56	npm run build:linux --dir
    
      57}
    
      58
    
      59package(){
    
      60	_arch=$(node -e "os=require('os'); console.log(os.arch());")-
    
      61	if [ ${_arch}==x64- ]
    
      62	then
    
      63		_arch=""
    
      64	fi
    
      65	cd "${srcdir}/${pkgname%-git}/dist-release/linux-unpacked"
    
      66	mkdir -p "${pkgdir}/opt/${pkgname%-git}"
    
      67	cp -r * "${pkgdir}/opt/${pkgname%-git}"
    
      68	mkdir -p "${pkgdir}/usr/bin"
    
      69	ln -s "/opt/${pkgname%-git}/${pkgname%-git}" "${pkgdir}/usr/bin/${pkgname%-git}"
    
      70	sed -i '5i\Name[zh_CN]=安卓投屏' "${srcdir}/${pkgname%-git}/${pkgname%-git}.desktop"
    
      71	install -Dm644 "${srcdir}/${pkgname%-git}/${pkgname%-git}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
    
      72	install -Dm644 "${srcdir}/${pkgname%-git}/dist/logo.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname%-git}.svg"
    
      73	install -Dm644 "${srcdir}/${pkgname%-git}/dist/logo-white.svg" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.svg"
    
      74}
    
      75
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2