midi2-workbench

maintainer osamc · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command is used to run electron-builder locally during the build process, which is a standard and legitimate use for packaging Electron applications; it does not execute arbitrary remote code or introduce a supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command is used to run electron-builder locally during the build process, which is a standard and legitimate use for packaging Electron applications; it does not execute arbitrary remote code or introduce a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:47 npx "${_npmargs[@]}" electron-builder -- \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: OSAMC <https://github.com/osam-cologne/archlinux-proaudio>
    
      2# Contributor: Florian Hülsmann <fh@cbix.de>
    
      3
    
      4_name=MIDI2.0Workbench
    
      5pkgname=midi2-workbench
    
      6pkgver=1.5.6
    
      7_ver=${pkgver}p
    
      8pkgrel=2
    
      9pkgdesc='MIDI 2.0 debugging utility'
    
      10arch=(x86_64)
    
      11url='https://github.com/midi2-dev/MIDI2.0Workbench'
    
      12license=(MIT)
    
      13_electron=electron43
    
      14depends=($_electron gcc-libs glibc)
    
      15makedepends=(alsa-lib node-gyp npm systemd-libs)
    
      16groups=(pro-audio)
    
      17source=(
    
      18  "$pkgname-$pkgver.tar.gz::https://github.com/midi2-dev/$_name/archive/refs/tags/v$_ver.tar.gz"
    
      19  'midi2-workbench.sh'
    
      20  'midi2-workbench.desktop'
    
      21)
    
      22sha256sums=('317fe57e371af684c557c167de0d5a824fe231b58af6a7baece8d565ddf76bf2'
    
      23            '874b315d24b7846f2a3b2cefba8d27085b45aaa355a6f26096ef5672db66d99b'
    
      24            'fe31fc81dfc72fbbb131c3a187b90cd924948c1bad5a0cbb6421771b92eb2c8c')
    
      25case $CARCH in
    
      26 aarch64) _arch=arm64 ;;
    
      27 x86_64) _arch=x64 ;;
    
      28 i686) _arch=ia32 ;;
    
      29esac
    
      30
    
      31prepare() {
    
      32  _npmargs=(--cache "$srcdir"/npm-cache --no-audit --no-fund)
    
      33  _electron_ver="$(< /usr/lib/$_electron/version)"
    
      34  cd $_name-$_ver
    
      35  # remove unused dependencies
    
      36  sed -e /serialport/d -e /bonjour-service/d -e /cobs/d -e /sanitize-filename/d -i package.json
    
      37  HOME="$srcdir"/.electron-gyp npm "${_npmargs[@]}" install --os linux --cpu $_arch
    
      38  # don't use prebuilt binaries and fix build
    
      39  rm -rf node_modules/usb/prebuilds
    
      40  sed -e 's/-std=c++14/-std=c++17/' -i node_modules/usb/binding.gyp
    
      41  # use system node-gyp
    
      42  ln -sf /usr/bin/node-gyp node_modules/.bin/node-gyp
    
      43}
    
      44
    
      45build() {
    
      46  cd $_name-$_ver
    
      47  npx "${_npmargs[@]}" electron-builder -- \
    
      48    --linux --$_arch --dir \
    
      49    -c.electronDist=/usr/lib/$_electron \
    
      50    -c.electronVersion=$_electron_ver \
    
      51    -c.asar=false \
    
      52    --publish=never
    
      53}
    
      54
    
      55package() {
    
      56  depends+=(libasound.so libudev.so)
    
      57  install -vDm755 $pkgname.sh "$pkgdir"/usr/bin/$pkgname
    
      58  install -vDm644 $pkgname.desktop -t "$pkgdir"/usr/share/applications
    
      59
    
      60  cd $_name-$_ver
    
      61  install -vDm644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
    
      62  install -vDm644 icon.png "$pkgdir"/usr/share/pixmaps/$pkgname.png
    
      63
    
      64  cd dist/linux-unpacked/resources
    
      65  # some cleanup
    
      66  rm -rf app/{midi2usb,winmidi2,*.png}
    
      67  install -d "$pkgdir"/usr/lib
    
      68  cp -a app "$pkgdir"/usr/lib/$pkgname
    
      69}
    
      70

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2