micyou-git

maintainer lemona · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx commands are used to build a project from its own source in the git repository, which is a normal part of the build process and not an execution of untrusted remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx commands are used to build a project from its own source in the git repository, which is a normal part of the build process and not an execution of untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:66 npx vite build
PKGBUILD:67 RUSTFLAGS="-C link-arg=-fuse-ld=mold" npx tauri build --no-bundle \

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: lemon <lemonadorable@gmail.com>
    
      2# Maintainer: raindropqwq <raindropqwq@outlook.com>
    
      3
    
      4pkgname=micyou-git
    
      5pkgver=2.0.0.alpha.1.r590.g06bf23c
    
      6pkgrel=1
    
      7pkgdesc="Turn your Android device into a wireless microphone (development version)"
    
      8arch=('x86_64')
    
      9keywords=('android' 'audio' 'microphone' 'pipewire' 'pulseaudio' 'wireless')
    
      10url="https://github.com/LanRhyme/MicYou"
    
      11license=('GPL-3.0-only')
    
      12depends=(
    
      13  'alsa-lib'
    
      14  'cairo'
    
      15  'gdk-pixbuf2'
    
      16  'glib2'
    
      17  'gtk3'
    
      18  'hicolor-icon-theme'
    
      19  'libayatana-appindicator'
    
      20  'libpulse'
    
      21  'libsoup3'
    
      22  'openssl'
    
      23  'pango'
    
      24  'pipewire'
    
      25  'webkit2gtk-4.1'
    
      26  'wireplumber'
    
      27)
    
      28makedepends=(
    
      29  'git'
    
      30  'mold'
    
      31  'rust'
    
      32  'cargo'
    
      33  'nodejs'
    
      34  'npm'
    
      35  'pkgconf'
    
      36)
    
      37optdepends=(
    
      38  'android-tools: USB connectivity support'
    
      39  'xdg-utils: open URLs in the default browser'
    
      40)
    
      41provides=('micyou')
    
      42conflicts=('micyou' 'micyou-bin')
    
      43source=(
    
      44  'git+https://github.com/LanRhyme/MicYou.git'
    
      45  'micyou.desktop'
    
      46)
    
      47b2sums=(
    
      48  'SKIP'
    
      49  'd72476f0b91fe3ec793d69b6a4c3546607149d1779a1e357284df23e7801aadff39fd5566a002fb4eb0d5393f8d03d4edc65408db8ddb485b8b912362015410e'
    
      50)
    
      51
    
      52pkgver() {
    
      53  cd MicYou
    
      54
    
      55  local base_version
    
      56  base_version=$(sed -n 's/^project.version=//p' gradle.properties | tr '-' '.')
    
      57  printf '%s.r%s.g%s' \
    
      58    "$base_version" \
    
      59    "$(git rev-list --count HEAD)" \
    
      60    "$(git rev-parse --short=7 HEAD)"
    
      61}
    
      62
    
      63build() {
    
      64  cd MicYou/tauri-app
    
      65  npm ci
    
      66  npx vite build
    
      67  RUSTFLAGS="-C link-arg=-fuse-ld=mold" npx tauri build --no-bundle \
    
      68    --config '{"build":{"beforeBuildCommand":""}}'
    
      69}
    
      70
    
      71package() {
    
      72  cd MicYou
    
      73
    
      74  install -Dm755 tauri-app/target/release/micyou-app \
    
      75    "$pkgdir/usr/bin/micyou"
    
      76
    
      77  install -Dm644 tauri-app/src-tauri/icons/128x128.png \
    
      78    "$pkgdir/usr/share/icons/hicolor/128x128/apps/micyou.png"
    
      79  install -Dm644 tauri-app/src-tauri/icons/icon.png \
    
      80    "$pkgdir/usr/share/icons/hicolor/512x512/apps/micyou.png"
    
      81
    
      82  install -Dm644 "$srcdir/micyou.desktop" \
    
      83    "$pkgdir/usr/share/applications/micyou.desktop"
    
      84  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/micyou/LICENSE"
    
      85}
    
      86

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2