masscode-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-09-11 01:21:31.837469
View on AUR
Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:92 NODE_ENV=development npm add markmap-common --legacy-peer-deps
Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:99 NODE_ENV=production npx vite build

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=masscode-git
3_pkgname=massCode
4pkgver=5.10.0.r15.gce3db7e
5_electronversion=34
6_nodeversion=24
7pkgrel=1
8pkgdesc="A free, open-source developer workspace. Snippets, notes, HTTP requests, calculations, 和 dev tools in one local-first app."
9arch=('any')
10url="https://masscode.io/"
11_ghurl="https://github.com/massCodeIO/massCode"
12license=('MIT')
13makedepends=(
14 'npm'
15 'pnpm'
16 'git'
17 'nvm'
18 'curl'
19 'gendesk'
20 'jq'
21)
22depends=(
23 "electron${_electronversion}"
24)
25source=(
26 "${pkgname//-/.}::git+${_ghurl}.git"
27 "${pkgname%-git}.sh"
28)
29sha256sums=('SKIP'
30 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
31pkgver() {
32 cd "${srcdir}/${pkgname//-/.}"
33 set -o pipefail
34 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
35 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
36}
37_get_app_dir() {
38 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
39}
40_set_build_env() {
41 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
42 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
43 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
44 _ev="$(electron${_electronversion} -v)"
45 export SYSTEM_ELECTRON_VERSION="${_ev#v}"
46 export HOME="${srcdir}/.electron-gyp"
47 export XDG_CACHE_HOME="${srcdir}/.cache"
48 export XDG_CONFIG_HOME="${srcdir}/.config"
49 export XDG_DATA_HOME="${srcdir}/.local/share"
50 export npm_config_cache="${srcdir}/.npm_cache"
51 export npm_config_devdir="${srcdir}/.node-gyp"
52 export npm_config_maxsockets=32
53 export npm_config_platform=linux
54 export npm_config_arch="${CARCH}"
55 export npm_config_audit=false
56 export npm_config_fund=false
57 export npm_config_progress=false
58 export NODE_OPTIONS="--max-old-space-size=4096"
59 export npm_config_node_options="--max-old-space-size=4096"
60}
61_ensure_local_nvm() {
62 local NVM_DIR="${srcdir}/.nvm"
63 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
64 nvm install "${_nodeversion}"
65 nvm use "${_nodeversion}"
66}
67_get_electron_version() {
68 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
69 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
70 [[ -z "${_elec_ver}" ]] && return 1
71 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
72}
73prepare() {
74 cd "${srcdir}/${pkgname//-/.}"
75 _get_electron_version
76 sed -i -e "
77 s/@electronversion@/${_electronversion}/g
78 s/@appname@/${pkgname%-git}/g
79 s/@runname@/app.asar/g
80 s/@cfgdirname@/${_pkgname}/g
81 " "${srcdir}/${pkgname%-git}.sh"
82 gendesk -q -f -n \
83 --pkgname="${pkgname%-git}" \
84 --pkgdesc="${pkgdesc}" \
85 --categories="Development" \
86 --name="${_pkgname}" \
87 --exec="${pkgname%-git} %U"
88 _set_build_env
89 _ensure_local_nvm
90 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
91 NODE_ENV=development npm install --legacy-peer-deps
92 NODE_ENV=development npm add markmap-common --legacy-peer-deps
93}
94build() {
95 cd "${srcdir}/${pkgname//-/.}"
96 _set_build_env
97 _ensure_local_nvm
98 NODE_ENV=production npm run rebuild
99 NODE_ENV=production npx vite build
100 NODE_ENV=production npm run build:main
101 NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.json"
102}
103package() {
104 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
105 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
106 local _app_dir=$(_get_app_dir)
107 cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-git}/"
108 install -Dm644 "${srcdir}/${pkgname//-/.}/build/icons/256x256.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
109 install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
110 install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
111}
112

Changes since previous scan

--- PKGBUILD @ 2026-07-06 11:20
+++ PKGBUILD @ 2026-09-11 01:21
@@ -1,11 +1,11 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=masscode-git
_pkgname=massCode
-pkgver=5.8.0.r0.g15f86fd
+pkgver=5.10.0.r15.gce3db7e
_electronversion=34
_nodeversion=24
pkgrel=1
-pkgdesc="A free and open source code snippets manager for developers.(Use system-wide electron)"
+pkgdesc="A free, open-source developer workspace. Snippets, notes, HTTP requests, calculations, 和 dev tools in one local-first app."
arch=('any')
url="https://masscode.io/"
_ghurl="https://github.com/massCodeIO/massCode"
@@ -38,30 +38,25 @@
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
}
_set_build_env() {
- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- export HOME="${srcdir}/.electron-gyp"
- {
- export PNPM_LINK_WORKSPACE_PACKAGES=true
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_SHAMEFULLY_HOIST=true
- export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
- export PNPM_NODE_LINKER=hoisted
- export PNPM_NETWORK_CONCURRENCY=32
- }
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export pnpm_config_registry="https://registry.npmmirror.com"
- export npm_config_registry="https://registry.npmmirror.com"
- export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
- export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- }
- fi
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ _ev="$(electron${_electronversion} -v)"
+ export SYSTEM_ELECTRON_VERSION="${_ev#v}"
+ export HOME="${srcdir}/.electron-gyp"
+ export XDG_CACHE_HOME="${srcdir}/.cache"
+ export XDG_CONFIG_HOME="${srcdir}/.config"
+ export XDG_DATA_HOME="${srcdir}/.local/share"
+ export npm_config_cache="${srcdir}/.npm_cache"
+ export npm_config_devdir="${srcdir}/.node-gyp"
+ export npm_config_maxsockets=32
+ export npm_config_platform=linux
+ export npm_config_arch="${CARCH}"
+ export npm_config_audit=false
+ export npm_config_fund=false
+ export npm_config_progress=false
+ export NODE_OPTIONS="--max-old-space-size=4096"
+ export npm_config_node_options="--max-old-space-size=4096"
}
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
@@ -93,22 +88,23 @@
_set_build_env
_ensure_local_nvm
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development pnpm install
+ NODE_ENV=development npm install --legacy-peer-deps
+ NODE_ENV=development npm add markmap-common --legacy-peer-deps
}
build() {
cd "${srcdir}/${pkgname//-/.}"
_set_build_env
_ensure_local_nvm
- NODE_ENV=production pnpm run rebuild
- NODE_ENV=production pnpm -c vite build
- NODE_ENV=production pnpm run build:main
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${electronDist} --config electron-builder.json"
+ NODE_ENV=production npm run rebuild
+ NODE_ENV=production npx vite build
+ NODE_ENV=production npm run build:main
+ NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.json"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
+ cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-git}/"
install -Dm644 "${srcdir}/${pkgname//-/.}/build/icons/256x256.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"

Scan history

Scanned at (UTC)SeverityRules
2026-09-11 01:21:31 Medium 2
2026-07-06 11:20:54 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion