media-compressor-git
LOW
maintainer zxp19821005
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The npx/bunx calls (tsc, vite build, electron-builder) are standard build tools invoked from the project's own locally-installed node_modules after 'bun install', not fetching arbitrary remote packages at runtime; the overall pattern is a normal Electron app built from the project's own GitHub source with system electron, posing no meaningful supply-chain risk beyond the usual AUR caveats.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The npx/bunx calls (tsc, vite build, electron-builder) are standard build tools invoked from the project's own locally-installed node_modules after 'bun install', not fetching arbitrary remote packages at runtime; the overall pattern is a normal Electron app built from the project's own GitHub source with system electron, posing no meaningful supply-chain risk beyond the usual AUR caveats.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:107
bunx tsc -
PKGBUILD:108
bunx vite build -
PKGBUILD:109
bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.json
PKGBUILD
3 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=media-compressor-git
3
_pkgname='Media Compressor'
4
pkgver=0.4.0.r9.gf977b43
5
_electronversion=33
6
_nodeversion=20
7
pkgrel=1
8
pkgdesc="A free, user-friendly application designed to simplify media file compression. Built with React and TypeScript, this lightweight tool helps you reduce file sizes without compromising quality."
9
arch=('any')
10
url="https://max-im.github.io/media-compressor/"
11
_ghurl="https://github.com/Max-im/media-compressor"
12
license=('MIT')
13
conflicts=("${pkgname%-git}")
14
provides=("${pkgname%-git}=${pkgver%.r*}")
15
depends=(
16
"electron${_electronversion}-bin"
17
'ffmpeg'
18
'nodejs'
19
)
20
makedepends=(
21
'gendesk'
22
'bun'
23
'nvm'
24
'git'
25
'jq'
26
'asar'
27
)
28
source=(
29
"${pkgname%-git}.git::git+${_ghurl}"
30
"${pkgname%-git}.sh"
31
)
32
sha256sums=('SKIP'
33
'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
34
_get_project_dir() {
35
local d
36
while IFS= read -r d; do
37
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
38
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
39
}
40
pkgver() {
41
cd "$(_get_project_dir)"
42
set -o pipefail
43
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
44
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
45
}
46
_ensure_local_nvm() {
47
local NVM_DIR="${srcdir}/.nvm"
48
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
49
nvm install "${_nodeversion}"
50
nvm use "${_nodeversion}"
51
}
52
_get_app_dir() {
53
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
54
}
55
_get_electron_version() {
56
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
57
| xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
58
| grep -oE '[0-9]+' | head -1)
59
[[ -z "${_elec_ver}" ]] && return 1
60
(( _elec_ver == _electronversion )) && c=32 || c=31
61
echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
62
}
63
_set_build_env() {
64
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
65
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
66
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
67
export ELECTRON_BUILDER_OFFLINE=true
68
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
69
export HOME="${srcdir}/.home"
70
export XDG_CACHE_HOME="${HOME}/.cache"
71
export XDG_CONFIG_HOME="${HOME}/.config"
72
export XDG_DATA_HOME="${HOME}/.local/share"
73
export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
74
export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
75
export BUN_INSTALL_BIN="${HOME}/.bun/bin"
76
export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
77
export BUN_CONFIG_SKIP_LOAD_LOCKFILE=1
78
export BUN_DISABLE_DOTENV=1
79
export DO_NOT_TRACK=1
80
export BUN_JOBS="$(nproc)"
81
mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
82
}
83
prepare() {
84
cd "$(_get_project_dir)/app"
85
_get_electron_version
86
sed -i -e "
87
s/@electronversion@/${_electronversion}/g
88
s/@appname@/${pkgname%-git}/g
89
" "${srcdir}/${pkgname%-git}.sh"
90
gendesk -q -f -n \
91
--pkgname="${pkgname%-git}" \
92
--pkgdesc="${pkgdesc}" \
93
--categories="Utility" \
94
--name="${pkgname%-git}" \
95
--exec="${pkgname%-git} %U"
96
_ensure_local_nvm
97
_set_build_env
98
find src -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
99
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
100
find src -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
101
bun install
102
}
103
build() {
104
cd "$(_get_project_dir)/app"
105
_ensure_local_nvm
106
_set_build_env
107
bunx tsc
108
bunx vite build
109
bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.json
110
ln -sf "/usr/bin/ffprobe" "$(_get_app_dir)/resources/app.asar.unpacked/node_modules/@ffprobe-installer/linux-x64/ffprobe"
111
ln -sf "/usr/bin/ffprobe" "$(_get_app_dir)/resources/app.asar.unpacked/node_modules/get-video-duration/node_modules/@ffprobe-installer/ffprobe/node_modules/@ffprobe-installer/linux-x64/ffprobe"
112
ln -sf "/usr/bin/ffmpeg" "$(_get_app_dir)/resources/app.asar.unpacked/node_modules/ffmpeg-static/ffmpeg"
113
}
114
package() {
115
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
116
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
117
rm -rf "$(_get_app_dir)/resources/default_app.asar"
118
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
119
install -Dm644 "$(_get_project_dir)/app/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
120
install -Dm644 "$(_get_project_dir)/app/build/icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname%-git}.png"
121
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
122
}
123
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 3 |
| 2026-10-16 00:12:47 | Low | 3 |
| 2026-10-15 00:28:05 | Low | 3 |
| 2026-10-14 00:06:47 | Low | 3 |
| 2026-10-13 09:18:16 | Low | 3 |
| 2026-10-13 09:16:20 | Medium | 2 |