masscode-git
LOW
maintainer zxp19821005
0 votes
scanned 2026-10-26 00:12:40.318206
Why flagged
The package builds from a legitimate project source on GitHub and uses standard development tools; the flagged npm/yarn/pnpm install of an undeclared external package (markmap-common) is a legitimate dev dependency added during build, not a malicious payload, and the variable-based package installation occurs in a controlled build context.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a legitimate project source on GitHub and uses standard development tools; the flagged npm/yarn/pnpm install of an undeclared external package (markmap-common) is a legitimate dev dependency added during build, not a malicious payload, and the variable-based package installation occurs in a controlled build context.
-
PKGBUILD:91
npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:115
pnpm add markmap-common
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=masscode-git
3
_pkgname=massCode
4
pkgver=6.3.1.r1.g5ea8aca
5
_electronversion=34
6
_nodeversion=24
7
pkgrel=1
8
pkgdesc="A free, open-source developer workspace. Snippets, notes, HTTP requests, calculations, and dev tools in one local-first app."
9
arch=('any')
10
url="https://masscode.io/"
11
_ghurl="https://github.com/massCodeIO/massCode"
12
license=('MIT')
13
makedepends=(
14
'npm'
15
'git'
16
'nvm'
17
'gendesk'
18
'jq'
19
)
20
depends=(
21
"electron${_electronversion}"
22
)
23
source=(
24
"${pkgname//-/.}::git+${_ghurl}.git"
25
"${pkgname%-git}.sh"
26
)
27
sha256sums=('SKIP'
28
'cebedc3391cbab6d43f37fbf3a87ddaad16597cb5ea487a4d55b1f478d810082')
29
_get_project_dir() {
30
local d
31
while IFS= read -r d; do
32
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
33
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
34
}
35
pkgver() {
36
cd "$(_get_project_dir)"
37
set -o pipefail
38
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
39
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
40
}
41
_ensure_local_nvm() {
42
local NVM_DIR="${srcdir}/.nvm"
43
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
44
nvm install "${_nodeversion}"
45
nvm use "${_nodeversion}"
46
}
47
_get_app_dir() {
48
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
49
| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
50
}
51
_get_electron_version() {
52
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
53
| xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
54
| grep -oE '[0-9]+' | head -1)
55
[[ -z "${_elec_ver}" ]] && return 1
56
(( _elec_ver == _electronversion )) && c=32 || c=31
57
echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
58
}
59
_set_build_env() {
60
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
61
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
62
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
63
export ELECTRON_BUILDER_OFFLINE=true
64
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
65
export HOME="${srcdir}/.home"
66
export XDG_CACHE_HOME="${HOME}/.cache"
67
export XDG_CONFIG_HOME="${HOME}/.config"
68
export XDG_DATA_HOME="${HOME}/.local/share"
69
export XDG_STATE_HOME="${HOME}/.local/state"
70
export PNPM_HOME="${HOME}/.pnpm/bin"
71
export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
72
export pnpm_config_store_dir="${HOME}/.pnpm_store"
73
export pnpm_config_global_dir="${HOME}/.pnpm/global"
74
export pnpm_config_state_dir="${HOME}/.pnpm/state"
75
export pnpm_config_node_linker=hoisted
76
export pnpm_config_minimum_release_age=0
77
export pnpm_config_update_notifier=false
78
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
79
export COREPACK_HOME="${HOME}/.corepack"
80
mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
81
export PATH="${PNPM_HOME}:${PATH}"
82
local _pnpmver=""
83
local _pkgjson="$(_get_project_dir)/package.json"
84
if [ -f "${_pkgjson}" ]; then
85
_pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
86
if [ -z "${_pnpmver}" ]; then
87
_pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
88
fi
89
fi
90
if [ -n "${_pnpmver}" ]; then
91
npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
92
--registry "${COREPACK_NPM_REGISTRY}"
93
fi
94
}
95
prepare() {
96
cd "$(_get_project_dir)"
97
_get_electron_version
98
sed -i -e "
99
s/@electronversion@/${_electronversion}/g
100
s/@appname@/${pkgname%-git}/g
101
s/@runname@/app.asar/g
102
" "${srcdir}/${pkgname%-git}.sh"
103
gendesk -q -f -n \
104
--pkgname="${pkgname%-git}" \
105
--pkgdesc="${pkgdesc}" \
106
--categories="Development" \
107
--name="${_pkgname}" \
108
--exec="${pkgname%-git} %U"
109
_ensure_local_nvm
110
_set_build_env
111
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
112
rm -rf pnpm-lock.yaml
113
export NODE_ENV=development
114
pnpm install
115
pnpm add markmap-common
116
}
117
build() {
118
cd "$(_get_project_dir)"
119
_ensure_local_nvm
120
_set_build_env
121
export NODE_ENV=production
122
pnpm run rebuild
123
pnpm vite build
124
pnpm run build:main
125
pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.json"
126
}
127
package() {
128
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
129
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
130
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
131
rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
132
install -Dm644 "$(_get_project_dir)/build/icons/256x256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-git}.png"
133
install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
134
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
135
}
136
Changes since previous scan
--- PKGBUILD @ 2026-10-20 00:10+++ PKGBUILD @ 2026-10-26 00:12@@ -1,7 +1,7 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> pkgname=masscode-git _pkgname=massCode-pkgver=6.2.1.r0.g9699535+pkgver=6.3.1.r1.g5ea8aca _electronversion=34 _nodeversion=24 pkgrel=1@@ -33,13 +33,28 @@ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*') } pkgver() {- cd "$(_get_project_dir)"- set -o pipefail- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"+ cd "$(_get_project_dir)"+ set -o pipefail+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"+}+_ensure_local_nvm() {+ local NVM_DIR="${srcdir}/.nvm"+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]+ nvm install "${_nodeversion}"+ nvm use "${_nodeversion}" } _get_app_dir() {- find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done+}+_get_electron_version() {+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \+ | grep -oE '[0-9]+' | head -1)+ [[ -z "${_elec_ver}" ]] && return 1+ (( _elec_ver == _electronversion )) && c=32 || c=31+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m" } _set_build_env() { export ELECTRON_DIST="/usr/lib/electron${_electronversion}"@@ -77,20 +92,6 @@ --registry "${COREPACK_NPM_REGISTRY}" fi }-_ensure_local_nvm() {- local NVM_DIR="${srcdir}/.nvm"- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]- nvm install "${_nodeversion}"- nvm use "${_nodeversion}"-}-_get_electron_version() {- _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \- | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \- | grep -oE '[0-9]+' | head -1)- [[ -z "${_elec_ver}" ]] && return 1- (( _elec_ver == _electronversion )) && c=32 || c=31- echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"-} prepare() { cd "$(_get_project_dir)" _get_electron_version@@ -126,12 +127,10 @@ package() { install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}" install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"- local _app_dir="$(_get_app_dir)"- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/" rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"- local _src="$(_get_project_dir)"- install -Dm644 "${_src}/build/icons/256x256.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"- install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"- install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"+ install -Dm644 "$(_get_project_dir)/build/icons/256x256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-git}.png"+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}" } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 07:27:55 | Medium | 1 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 05:12:20 | Medium | 1 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |