midi2-workbench

LOW

maintainer osamc 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx command is used to run electron-builder locally during the build process, which is a standard and legitimate use for packaging Electron applications; it does not execute arbitrary remote code or introduce a supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command is used to run electron-builder locally during the build process, which is a standard and legitimate use for packaging Electron applications; it does not execute arbitrary remote code or introduce a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:47 npx "${_npmargs[@]}" electron-builder -- \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: OSAMC <https://github.com/osam-cologne/archlinux-proaudio>
    
      2# Contributor: Florian Hülsmann <fh@cbix.de>
    
      3
    
      4_name=MIDI2.0Workbench
    
      5pkgname=midi2-workbench
    
      6pkgver=1.5.6
    
      7_ver=${pkgver}p
    
      8pkgrel=2
    
      9pkgdesc='MIDI 2.0 debugging utility'
    
      10arch=(x86_64)
    
      11url='https://github.com/midi2-dev/MIDI2.0Workbench'
    
      12license=(MIT)
    
      13_electron=electron43
    
      14depends=($_electron gcc-libs glibc)
    
      15makedepends=(alsa-lib node-gyp npm systemd-libs)
    
      16groups=(pro-audio)
    
      17source=(
    
      18  "$pkgname-$pkgver.tar.gz::https://github.com/midi2-dev/$_name/archive/refs/tags/v$_ver.tar.gz"
    
      19  'midi2-workbench.sh'
    
      20  'midi2-workbench.desktop'
    
      21)
    
      22sha256sums=('317fe57e371af684c557c167de0d5a824fe231b58af6a7baece8d565ddf76bf2'
    
      23            '874b315d24b7846f2a3b2cefba8d27085b45aaa355a6f26096ef5672db66d99b'
    
      24            'fe31fc81dfc72fbbb131c3a187b90cd924948c1bad5a0cbb6421771b92eb2c8c')
    
      25case $CARCH in
    
      26 aarch64) _arch=arm64 ;;
    
      27 x86_64) _arch=x64 ;;
    
      28 i686) _arch=ia32 ;;
    
      29esac
    
      30
    
      31prepare() {
    
      32  _npmargs=(--cache "$srcdir"/npm-cache --no-audit --no-fund)
    
      33  _electron_ver="$(< /usr/lib/$_electron/version)"
    
      34  cd $_name-$_ver
    
      35  # remove unused dependencies
    
      36  sed -e /serialport/d -e /bonjour-service/d -e /cobs/d -e /sanitize-filename/d -i package.json
    
      37  HOME="$srcdir"/.electron-gyp npm "${_npmargs[@]}" install --os linux --cpu $_arch
    
      38  # don't use prebuilt binaries and fix build
    
      39  rm -rf node_modules/usb/prebuilds
    
      40  sed -e 's/-std=c++14/-std=c++17/' -i node_modules/usb/binding.gyp
    
      41  # use system node-gyp
    
      42  ln -sf /usr/bin/node-gyp node_modules/.bin/node-gyp
    
      43}
    
      44
    
      45build() {
    
      46  cd $_name-$_ver
    
      47  npx "${_npmargs[@]}" electron-builder -- \
    
      48    --linux --$_arch --dir \
    
      49    -c.electronDist=/usr/lib/$_electron \
    
      50    -c.electronVersion=$_electron_ver \
    
      51    -c.asar=false \
    
      52    --publish=never
    
      53}
    
      54
    
      55package() {
    
      56  depends+=(libasound.so libudev.so)
    
      57  install -vDm755 $pkgname.sh "$pkgdir"/usr/bin/$pkgname
    
      58  install -vDm644 $pkgname.desktop -t "$pkgdir"/usr/share/applications
    
      59
    
      60  cd $_name-$_ver
    
      61  install -vDm644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
    
      62  install -vDm644 icon.png "$pkgdir"/usr/share/pixmaps/$pkgname.png
    
      63
    
      64  cd dist/linux-unpacked/resources
    
      65  # some cleanup
    
      66  rm -rf app/{midi2usb,winmidi2,*.png}
    
      67  install -d "$pkgdir"/usr/lib
    
      68  cp -a app "$pkgdir"/usr/lib/$pkgname
    
      69}
    
      70

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2