meru-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-10-07 06:05:09.924014
View on AUR
Why flagged

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:106 bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=meru-git
3_pkgname=meru
4pkgver=3.63.0.r0.g421198c
5_electronversion=43
6_nodeversion=24
7pkgrel=1
8pkgdesc="📮 Nifty Gmail desktop app for macOS, Linux & Windows (previously Gmail Desktop)."
9arch=('any')
10url="https://meru.so/"
11_ghurl="https://github.com/zoidsh/meru"
12license=('MIT')
13provides=("${pkgname%-git}=${pkgver%.r*}")
14conflicts=("${pkgname%-git}")
15depends=(
16 "electron${_electronversion}"
17)
18makedepends=(
19 'bun'
20 'git'
21 'nvm'
22 'gendesk'
23 'jq'
24)
25source=(
26 "${pkgname%-git}.git::git+${_ghurl}.git"
27 "${pkgname%-git}.sh"
28)
29sha256sums=('SKIP'
30 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
31_get_project_dir() {
32 local d
33 while IFS= read -r d; do
34 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
35 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
36}
37pkgver() {
38 cd "$(_get_project_dir)"
39 set -o pipefail
40 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
41 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
42}
43_ensure_local_nvm() {
44 local NVM_DIR="${srcdir}/.nvm"
45 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
46 nvm install "${_nodeversion}"
47 nvm use "${_nodeversion}"
48}
49_set_build_env() {
50 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
51 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
52 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
53 export ELECTRON_BUILDER_OFFLINE=true
54 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
55 export HOME="${srcdir}/.home"
56 export XDG_CACHE_HOME="${HOME}/.cache"
57 export XDG_CONFIG_HOME="${HOME}/.config"
58 export XDG_DATA_HOME="${HOME}/.local/share"
59 export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
60 export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
61 export BUN_INSTALL_BIN="${HOME}/.bun/bin"
62 export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
63 export BUN_CONFIG_SKIP_LOAD_LOCKFILE=1
64 export BUN_DISABLE_DOTENV=1
65 export DO_NOT_TRACK=1
66 export BUN_JOBS="$(nproc)"
67 mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
68}
69_get_app_dir() {
70 find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
71}
72_get_electron_version() {
73 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
74 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
75 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
76 [[ -z "${_elec_ver}" ]] && return 1
77 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
78}
79prepare() {
80 cd "$(_get_project_dir)"
81 _get_electron_version
82 sed -i -e "
83 s/@electronversion@/${_electronversion}/g
84 s/@appname@/${pkgname%-git}/g
85 s/@runname@/app.asar/g
86 s/@cfgdirname@/${_pkgname}/g
87 " "${srcdir}/${pkgname%-git}.sh"
88 gendesk -q -f -n \
89 --pkgname="${pkgname%-git}" \
90 --pkgdesc="${pkgdesc}" \
91 --categories="Network;Office" \
92 --name="${_pkgname}" \
93 --exec="${pkgname%-git} %U"
94 _ensure_local_nvm
95 _set_build_env
96 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
97 rm -rf bun.lock
98 bun install
99}
100build() {
101 cd "$(_get_project_dir)"
102 _ensure_local_nvm
103 _set_build_env
104 bun run build:js
105 bun run build:clean-dist
106 bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
107}
108package() {
109 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
110 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
111 local _app_dir="$(_get_app_dir)"
112 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
113 local _src="$(_get_project_dir)"
114 rm -f "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
115 _icon_sizes=(16x16 32x32 48x48 64x64 128x128 256x256 512x512)
116 for _icons in "${_icon_sizes[@]}";do
117 install -Dm644 "${_src}/build/icons/${_icon_sizes}.png" \
118 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
119 done
120 install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
121 install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
122}

Changes since previous scan

--- PKGBUILD @ 2026-09-07 03:13
+++ PKGBUILD @ 2026-10-07 06:05
@@ -1,11 +1,11 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=meru-git
_pkgname=meru
-pkgver=3.60.0.r5.g24afa36
+pkgver=3.63.0.r0.g421198c
_electronversion=43
_nodeversion=24
pkgrel=1
-pkgdesc="📮 Nifty Gmail desktop app for macOS, Linux & Windows (previously Gmail Desktop).(Use system-wide electron)"
+pkgdesc="📮 Nifty Gmail desktop app for macOS, Linux & Windows (previously Gmail Desktop)."
arch=('any')
url="https://meru.so/"
_ghurl="https://github.com/zoidsh/meru"
@@ -20,7 +20,6 @@
'git'
'nvm'
'gendesk'
- 'curl'
'jq'
)
source=(
@@ -28,9 +27,15 @@
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
@@ -43,33 +48,36 @@
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_OVERRIDE_DIST_PATH="${electronDist}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- export HOME="${srcdir}/.electron-gyp"
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- export BUN_CONFIG_REGISTRY="https://registry.npmmirror.com"
- export npm_config_registry="https://registry.npmmirror.com"
- export BUN_INSTALL_DISABLE_DEFAULT_REGISTRY_FALLBACK=1
- export npm_config_nodejs_org_mirror="https://npmmirror.com/mirrors/node"
- export NVM_NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron"
- export npm_config_electron_mirror="https://npmmirror.com/mirrors/electron/"
- export BUN_BINARY_MIRROR_OVERRIDE="https://npmmirror.com/-/binary/"
- find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
- fi
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
+ export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
+ export BUN_INSTALL_BIN="${HOME}/.bun/bin"
+ export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
+ export BUN_CONFIG_SKIP_LOAD_LOCKFILE=1
+ export BUN_DISABLE_DOTENV=1
+ export DO_NOT_TRACK=1
+ export BUN_JOBS="$(nproc)"
+ mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
@@ -83,31 +91,32 @@
--categories="Network;Office" \
--name="${_pkgname}" \
--exec="${pkgname%-git} %U"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ rm -rf bun.lock
bun install
}
build() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
bun run build:js
bun run build:clean-dist
- bun x electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
+ bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
+ local _app_dir="$(_get_app_dir)"
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ local _src="$(_get_project_dir)"
rm -f "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
_icon_sizes=(16x16 32x32 48x48 64x64 128x128 256x256 512x512)
for _icons in "${_icon_sizes[@]}";do
- install -Dm644 "${srcdir}/${pkgname%-git}.git/build/icons/${_icon_sizes}.png" \
+ install -Dm644 "${_src}/build/icons/${_icon_sizes}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
done
- install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
-

Scan history

Scanned at (UTC)SeverityRules
2026-10-07 06:05:09 Medium 1
2026-09-07 03:13:17 Clean 0
2026-07-06 13:21:03 Clean 0
2026-06-25 22:23:36 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion