mesh-client

maintainer victorix · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt Electron app from a GitHub release without verifying the source code, posing a supply-chain risk if the binary were tampered with.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt Electron app from a GitHub release without verifying the source code, posing a supply-chain risk if the binary were tampered with.

PKGBUILD

      1pkgname='mesh-client'
    
      2pkgver=5.24.1
    
      3pkgrel=1
    
      4pkgdesc='Cross-platform Electron desktop client for Meshtastic, MeshCore, and Reticulum (LXMF) on macOS, Linux, and Windows with BLE, USB serial, Wi-Fi/TCP, MQTT, local SQLite history, routing diagnostics, and 16-language UI.'
    
      5arch=('x86_64')
    
      6url='https://github.com/Colorado-Mesh/mesh-client'
    
      7license=('MIT')
    
      8options=(!strip !debug)
    
      9depends=(
    
      10    'gtk3'
    
      11    'nss'
    
      12    'nspr'
    
      13    'at-spi2-core'
    
      14    'libxcomposite'
    
      15    'libxdamage'
    
      16    'libxrandr'
    
      17    'libxkbcommon'
    
      18    'alsa-lib'
    
      19    'dbus'
    
      20    'cups'
    
      21)
    
      22_deb_package="mesh-client_5.24.1_amd64.deb"
    
      23source=("$_deb_package::https://github.com/Colorado-Mesh/mesh-client/releases/download/v5.24.1/$_deb_package")
    
      24md5sums=('1c8997efa68f482bf3669b48a650989f')
    
      25package() {
    
      26    cd "$srcdir"
    
      27    ar x "$_deb_package"
    
      28    tar xf data.tar.xz -C "$pkgdir"
    
      29
    
      30    find "$pkgdir/opt/Mesh-client/resources/app.asar.unpacked/node_modules" \
    
      31        -type d \
    
      32        \( \
    
      33            -name "android-*" \
    
      34            -o -name "linux-arm*" \
    
      35            -o -name "linux-ia32" \
    
      36            -o -name "linux-x86" \
    
      37            -o -name "darwin-*" \
    
      38            -o -name "win32-*" \
    
      39        \) \
    
      40        -prune -exec rm -rf {} +
    
      41
    
      42    rm -rf "$pkgdir/opt/Mesh-client/resources/reticulum-sidecar/staged/linux-arm64"
    
      43
    
      44    find "$pkgdir/opt/Mesh-client/resources/app.asar.unpacked/node_modules" \
    
      45        -name "*.musl.node" \
    
      46        -delete
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 19:25:44	MEDIUM	2