machctrl

maintainer Anderson_Araujo · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx commands are used to build the project's own frontend from source during packaging, not to execute arbitrary remote code; the source is from the project's GitHub repository and the build process is standard for Electron apps.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx commands are used to build the project's own frontend from source during packaging, not to execute arbitrary remote code; the source is from the project's GitHub repository and the build process is standard for Electron apps.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:43 npx vite build
PKGBUILD:44 npx electron-builder build --linux dir

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: araujo791 <https://github.com/araujo791>
    
      2pkgname=machctrl
    
      3pkgver=2.0.2
    
      4pkgrel=1
    
      5pkgdesc="Hardware Monitor and Optimizer for Linux — CPU, GPU, RAM, Fans, Temperature | Requires KDE Plasma or GNOME"
    
      6arch=('x86_64')
    
      7url="https://github.com/araujo791/machctrl"
    
      8license=('MIT')
    
      9depends=(
    
      10    'python'
    
      11    'python-psutil'
    
      12    'python-websockets'
    
      13    'lm_sensors'
    
      14    'dmidecode'
    
      15)
    
      16makedepends=(
    
      17    'git'
    
      18    'nodejs'
    
      19    'npm'
    
      20)
    
      21optdepends=(
    
      22    'nvidia-utils: suporte a GPU NVIDIA (fan control, temperatura)'
    
      23    'nvidia-settings: controle avançado de fan NVIDIA'
    
      24)
    
      25
    
      26# ⚠️  Interface gráfica requer ambiente de desktop com suporte a Electron:
    
      27#     KDE Plasma ou GNOME são os ambientes testados e suportados.
    
      28#     Ambientes minimalistas (i3, sway, etc) podem exigir configuração adicional.
    
      29provides=('machctrl')
    
      30conflicts=('machctrl-git' 'machctrl-bin')
    
      31install=machctrl.install
    
      32source=("$pkgname-$pkgver.tar.gz::https://github.com/araujo791/machctrl/archive/refs/heads/main.tar.gz")
    
      33sha256sums=('SKIP')
    
      34
    
      35build() {
    
      36    cd "$srcdir/machctrl-main"
    
      37    # Verifica se node/npm estão disponíveis
    
      38    if ! command -v node &>/dev/null; then
    
      39        echo "ERRO: nodejs não encontrado. Instale com: sudo pacman -S nodejs npm"
    
      40        exit 1
    
      41    fi
    
      42    npm install --prefer-offline
    
      43    npx vite build
    
      44    npx electron-builder build --linux dir
    
      45}
    
      46
    
      47package() {
    
      48    cd "$srcdir/machctrl-main"
    
      49
    
      50    # Instala linux-unpacked diretamente (sem AppImage, sem FUSE)
    
      51    install -dm755 "$pkgdir/opt/machctrl/app"
    
      52    cp -r dist-electron/linux-unpacked/. "$pkgdir/opt/machctrl/app/"
    
      53    # Torna todos os binários executáveis
    
      54    find "$pkgdir/opt/machctrl/app/" -maxdepth 1 -type f -exec chmod 755 {} \;
    
      55
    
      56    # Backend Python
    
      57    install -Dm644 backend/machctrl_server.py "$pkgdir/opt/machctrl/backend/machctrl_server.py"
    
      58
    
      59    # Launcher
    
      60    install -dm755 "$pkgdir/usr/local/bin"
    
      61    cat > "$pkgdir/usr/local/bin/machctrl" << 'LAUNCHER'
    
      62#!/bin/bash
    
      63# Suporte a Wayland e X11
    
      64if [ "$XDG_SESSION_TYPE" = "wayland" ]; then
    
      65    WAYLAND_FLAGS="--enable-features=UseOzonePlatform --ozone-platform=wayland"
    
      66else
    
      67    WAYLAND_FLAGS=""
    
      68fi
    
      69BIN=$(ls /opt/machctrl/app/ | grep -iE "^machctrl$" | head -1)
    
      70[ -z "$BIN" ] && BIN=$(ls /opt/machctrl/app/ | grep -v "\." | head -1)
    
      71exec /opt/machctrl/app/$BIN $WAYLAND_FLAGS "$@"
    
      72LAUNCHER
    
      73    chmod 755 "$pkgdir/usr/local/bin/machctrl"
    
      74
    
      75    # Ícone
    
      76    if [[ -f src/assets/app-icon.png ]]; then
    
      77        install -Dm644 src/assets/app-icon.png \
    
      78            "$pkgdir/usr/share/pixmaps/machctrl.png"
    
      79        install -Dm644 src/assets/app-icon.png \
    
      80            "$pkgdir/usr/share/icons/hicolor/256x256/apps/machctrl.png"
    
      81    fi
    
      82
    
      83    # .desktop
    
      84    install -dm755 "$pkgdir/usr/share/applications"
    
      85    cat > "$pkgdir/usr/share/applications/machctrl.desktop" << 'DESKTOP'
    
      86[Desktop Entry]
    
      87Name=MachCtrl
    
      88GenericName=Monitor de Hardware
    
      89Comment=Monitor e Otimizador de Hardware para Linux
    
      90Exec=/usr/local/bin/machctrl
    
      91Icon=machctrl
    
      92Terminal=false
    
      93Type=Application
    
      94Categories=System;Monitor;
    
      95Keywords=hardware;cpu;gpu;ram;monitor;temperatura;fans;
    
      96StartupNotify=true
    
      97DESKTOP
    
      98
    
      99    # Serviço systemd
    
      100    install -dm755 "$pkgdir/usr/lib/systemd/system"
    
      101    cat > "$pkgdir/usr/lib/systemd/system/machctrl-backend.service" << 'SERVICE'
    
      102[Unit]
    
      103Description=MachCtrl Backend
    
      104After=network.target
    
      105Wants=lm-sensors.service
    
      106
    
      107[Service]
    
      108Type=simple
    
      109ExecStart=/usr/bin/python3 /opt/machctrl/backend/machctrl_server.py
    
      110WorkingDirectory=/opt/machctrl
    
      111Restart=on-failure
    
      112RestartSec=5
    
      113User=root
    
      114Environment=PYTHONUNBUFFERED=1
    
      115StandardOutput=journal
    
      116StandardError=journal
    
      117SyslogIdentifier=machctrl
    
      118
    
      119[Install]
    
      120WantedBy=multi-user.target
    
      121SERVICE
    
      122
    
      123    # sudoers para dmidecode (leitura de RAM)
    
      124    install -dm750 "$pkgdir/etc/sudoers.d"
    
      125    echo "root ALL=(ALL) NOPASSWD: /usr/sbin/dmidecode" \
    
      126        > "$pkgdir/etc/sudoers.d/machctrl"
    
      127    chmod 440 "$pkgdir/etc/sudoers.d/machctrl"
    
      128}
    
      129

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2