materialious

maintainer yochananmarqos · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The flagged npx calls are legitimate: 'npx cap telemetry off' disables Capacitor telemetry, 'npx cap sync @capacitor-community/electron' syncs the Capacitor Electron platform (both use the locally installed 'cap' CLI from npm ci), and 'npx electron-builder build' invokes the locally installed electron-builder. None of these fetch remote packages at runtime since npm ci installs all dependencies from package-lock.json first. The source is fetched from the official GitHub release tarball with a pinned sha256sum. The nvm usage is a common AUR pattern for managing Node.js versions in the build environment. The only concern is the standard supply-chain risk inherent in any npm-based build (npm ci pulls many packages), but this is not malicious behavior specific to this PKGBUILD.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The flagged npx calls are legitimate: 'npx cap telemetry off' disables Capacitor telemetry, 'npx cap sync @capacitor-community/electron' syncs the Capacitor Electron platform (both use the locally installed 'cap' CLI from npm ci), and 'npx electron-builder build' invokes the locally installed electron-builder. None of these fetch remote packages at runtime since npm ci installs all dependencies from package-lock.json first. The source is fetched from the official GitHub release tarball with a pinned sha256sum. The nvm usage is a common AUR pattern for managing Node.js versions in the build environment. The only concern is the standard supply-chain risk inherent in any npm-based build (npm ci pulls many packages), but this is not malicious behavior specific to this PKGBUILD.

1 higher static finding superseded - not the current verdict (shown for transparency)

HIGH npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell.

PKGBUILD:58 npx cap telemetry off
PKGBUILD:59 npx cap sync @capacitor-community/electron
PKGBUILD:65 npx electron-builder build --linux dir -c ./electron-builder.config.json \

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
    
      2pkgname=materialious
    
      3_app_id=us.materialio.Materialious
    
      4pkgver=1.17.10
    
      5pkgrel=1
    
      6_nodeversion=24
    
      7_electronversion=43
    
      8pkgdesc="Modern material design for Invidious."
    
      9arch=('x86_64')
    
      10url="https://materialio.us"
    
      11license=('AGPL-3.0-or-later')
    
      12depends=("electron${_electronversion}")
    
      13makedepends=(
    
      14  'desktop-file-utils'
    
      15  'nvm'
    
      16  'python'
    
      17)
    
      18checkdepends=('appstream')
    
      19source=("Materialious-$pkgver.tar.gz::https://github.com/Materialious/Materialious/archive/refs/tags/$pkgver.tar.gz"
    
      20        "$pkgname.sh")
    
      21sha256sums=('6ff8a3156863ba83305ea6ff8e2143ec742731aec78cc44bbe20254f280e7897'
    
      22            'ae23af6865ab1638d46df5158fa09d41357f57068f1676af86e1a0e6e00459ed')
    
      23
    
      24_ensure_local_nvm() {
    
      25  # let's be sure we are starting clean
    
      26  which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      27  export NVM_DIR="$srcdir/.nvm"
    
      28
    
      29  # The init script returns 3 if version specified
    
      30  # in ./.nvrc is not (yet) installed in $NVM_DIR
    
      31  # but nvm itself still gets loaded ok
    
      32  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      33}
    
      34
    
      35prepare() {
    
      36  _ensure_local_nvm
    
      37  nvm install "${_nodeversion}"
    
      38
    
      39  cd "Materialious-$pkgver/$pkgname"
    
      40
    
      41  # Set desktop file Exec
    
      42  desktop-file-edit --set-key=Exec --set-value="$pkgname" "electron/$pkgname.desktop"
    
      43
    
      44  # Set Electron version
    
      45  sed -i "s|@ELECTRONVERSION@|${_electronversion}|" "$srcdir/$pkgname.sh"
    
      46}
    
      47
    
      48build() {
    
      49  cd "Materialious-$pkgver/$pkgname"
    
      50  export npm_config_cache="$srcdir/npm_cache"
    
      51  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      52  electronDist="/usr/lib/electron${_electronversion}"
    
      53  electronVer="$(sed s/^v// /usr/lib/electron${_electronversion}/version)"
    
      54  _ensure_local_nvm
    
      55  npm ci
    
      56  npm run build
    
      57  npm prune --omit=dev
    
      58  npx cap telemetry off
    
      59  npx cap sync @capacitor-community/electron
    
      60
    
      61  cd electron
    
      62  python patch_capacitor_plugin.py
    
      63  npm ci
    
      64  npm run build
    
      65  npx electron-builder build --linux dir -c ./electron-builder.config.json \
    
      66    -c.electronDist=$electronDist -c.electronVersion=$electronVer
    
      67}
    
      68
    
      69check() {
    
      70  cd "Materialious-$pkgver/$pkgname/electron"
    
      71  appstreamcli validate --no-net "$pkgname.metainfo.xml" || :
    
      72  desktop-file-validate "$pkgname.desktop"
    
      73}
    
      74
    
      75package() {
    
      76  cd "Materialious-$pkgver/$pkgname/electron"
    
      77  install -Dm644 dist/linux-unpacked/resources/app.asar -t "$pkgdir/usr/lib/$pkgname/"
    
      78  cp -a dist/linux-unpacked/resources/app.asar.unpacked -t "$pkgdir/usr/lib/$pkgname/"
    
      79  install -Dm644 assets/appIcon.png \
    
      80    "$pkgdir/usr/share/icons/hicolor/512x512/apps/${_app_id}.png"
    
      81  install -Dm644 "$pkgname.desktop" "$pkgdir/usr/share/applications/${_app_id}.desktop"
    
      82  install -Dm644 "$pkgname.metainfo.xml" "$pkgdir/usr/share/metainfo/${_app_id}.metainfo.xml"
    
      83  install -Dm755 "$srcdir/$pkgname.sh" "$pkgdir/usr/bin/$pkgname"
    
      84}
    
      85

Changes since previous scan

--- PKGBUILD @ 2026-07-29 17:15
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,7 +1,7 @@
 # Maintainer: Mark Wagie <mark dot wagie at proton dot me>
 pkgname=materialious
 _app_id=us.materialio.Materialious
-pkgver=1.17.6
+pkgver=1.17.10
 pkgrel=1
 _nodeversion=24
 _electronversion=43
@@ -18,7 +18,7 @@
 checkdepends=('appstream')
 source=("Materialious-$pkgver.tar.gz::https://github.com/Materialious/Materialious/archive/refs/tags/$pkgver.tar.gz"
         "$pkgname.sh")
-sha256sums=('8fb5455f76c15940206fa57b9cd9fbb96577ec1f6b498c3e26a97a2fcaf9577c'
+sha256sums=('6ff8a3156863ba83305ea6ff8e2143ec742731aec78cc44bbe20254f280e7897'
             'ae23af6865ab1638d46df5158fa09d41357f57068f1676af86e1a0e6e00459ed')
 
 _ensure_local_nvm() {
@@ -75,6 +75,7 @@
 package() {
   cd "Materialious-$pkgver/$pkgname/electron"
   install -Dm644 dist/linux-unpacked/resources/app.asar -t "$pkgdir/usr/lib/$pkgname/"
+  cp -a dist/linux-unpacked/resources/app.asar.unpacked -t "$pkgdir/usr/lib/$pkgname/"
   install -Dm644 assets/appIcon.png \
     "$pkgdir/usr/share/icons/hicolor/512x512/apps/${_app_id}.png"
   install -Dm644 "$pkgname.desktop" "$pkgdir/usr/share/applications/${_app_id}.desktop"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 15:31:07	LOW	2
2026-08-11 15:21:23	HIGH	1
2026-07-29 17:15:48	CLEAN	2
2026-07-29 17:12:22	HIGH	1
2026-07-12 17:43:53	CLEAN	2
2026-07-12 17:40:40	HIGH	1
2026-07-04 17:17:13	CLEAN	2
2026-07-04 17:14:52	HIGH	1
2026-07-04 00:27:25	LOW	2
2026-07-03 00:17:07	LOW	2
2026-07-02 18:47:07	LOW	2
2026-07-02 00:22:12	LOW	2
2026-07-01 00:30:02	LOW	2