mineradio
LOW
maintainer Sthn
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The npx command runs electron-builder on the project's own source code from a trusted GitHub repository; this is a standard build step for Electron apps and does not execute untrusted remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs electron-builder on the project's own source code from a trusted GitHub repository; this is a standard build step for Electron apps and does not execute untrusted remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:77
npx electron-builder --linux dir --config.electronDist=/usr/lib/electron43
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Sthn
2
#
3
# ─── 关于 / About ───────────────────────────────────────────────────────
4
# Mineradio 是一款沉浸式音乐播放器，融合天气电台、歌词舞台、粒子视觉和 3D 歌单架。
5
# 原项目由 XxHuberrr 设计与开发，仅支持 Windows。
6
# https://github.com/XxHuberrr/Mineradio-paused
7
# 上游自 v2.2.0 起长期停更（README 声明允许玩家 fork / 二创），本包基于 v2.2.0 源码构建。
8
#
9
# ─── 停更说明 / Upstream status ────────────────────────────────────────
10
# 由于原作者自身的原因，原项目暂时停更了。如果后续原作者继续更新，
11
# 本包也会相应推送新版本到 AUR 上。
12
#
13
# The upstream project is currently on hold for personal reasons of the original
14
# author. If upstream resumes updating, this package will be updated on the AUR
15
# accordingly.
16
#
17
# 本 AUR 包是社区维护的 Linux 移植版，在原作者代码基础上做了以下适配：
18
# 1. GPU 渲染：移除 Windows 专属的 use-angle=d3d11 等开关，修复 Linux 下 GPU 崩溃
19
# 2. 图标格式：Linux 下使用 icon.png 替代 icon.ico（含 favicon）
20
# 3. 缓存路径：将 D:\MineradioCache 改为 ~/.cache/Mineradio（符合 XDG 规范，含 beatmap）
21
# 4. 窗口配置：Linux 下关闭透明窗口（Wayland 渲染异常），保留无边框自带标题栏
22
# 5. 全屏：Linux 下跳过 setResizable guard（与 setFullScreen 冲突），全屏保持标题栏显示并避开登录信息重叠
23
# 6. 桌面歌词：Linux 下窗口可交互（中键切换锁定 + 左键拖动）；Wayland 无法全局监听中键，故锁定后不再点击穿透
24
# 7. 构建配置：package.json 添加 electron-builder Linux 构建目标
25
#
26
# 登录彩蛋：登录前有一道"世界和平"彩蛋门。解锁方式：
27
# 点右上角"扫码登录" → 连续点击眼睛图标 5 次（有提示）→ 输入"世界和平" → 解锁登录界面。
28
#
29
# 所有视觉设计、品牌、核心代码版权归原作者 XxHuberrr 所有。
30
# 本包遵循 GPL-3.0 授权。第三方音乐平台接入仅用于个人学习，请遵守各平台用户协议。
31
32
pkgname=mineradio
33
pkgver=2.2.0
34
pkgrel=1
35
pkgdesc='沉浸式音乐播放器，融合天气电台、歌词舞台、粒子视觉和 3D 歌单架 (Linux port, 原作者 XxHuberrr)'
36
arch=('x86_64')
37
url='https://github.com/XxHuberrr/Mineradio-paused'
38
license=('GPL-3.0-only')
39
depends=(
40
'electron'
41
'gtk3'
42
'libxss'
43
'nss'
44
'alsa-lib'
45
'mpg123'
46
'ffmpeg'
47
'xdg-utils'
48
)
49
makedepends=(
50
'nodejs'
51
'npm'
52
'git'
53
)
54
provides=('mineradio')
55
conflicts=('mineradio-git')
56
install=mineradio.install
57
source=("$pkgname-$pkgver.tar.gz::https://github.com/XxHuberrr/Mineradio-paused/archive/refs/tags/v$pkgver.tar.gz"
58
'mineradio.desktop'
59
'mineradio.sh'
60
'apply-linux-fixes.py')
61
sha256sums=('457c503f9d713bebd188c1d891d2298fc526cbb32315b87fdd518f10d44f7400'
62
'1e8e8df650d2bc9bac24a950ff89edd94e6f2bd07a4761b64cc3d642884935ef'
63
'369442e807ef1de63c4dced29c2b940e545e62c82d64315fe3ff9b3d835aa493'
64
'c754fbb6fd5d6f8a59f33f504d53b2c44dc0dee4cffa25ca646bc0f2706931c5')
65
66
build() {
67
# 上游仓库改名为 Mineradio-paused，tarball 顶层目录随之变化
68
cd "$srcdir/Mineradio-paused-$pkgver"
69
70
# Apply Linux compatibility fixes (icon, GPU switches, cache path, window/fullscreen/lyrics)
71
python3 "$srcdir/apply-linux-fixes.py" .
72
73
# Install npm dependencies (including devDependencies for electron-builder)
74
npm install --prefer-offline
75
76
# Build Linux directory using system Electron (no download needed)
77
npx electron-builder --linux dir --config.electronDist=/usr/lib/electron43
78
}
79
80
package() {
81
cd "$srcdir/Mineradio-paused-$pkgver"
82
83
# Install only the app resources (not the bundled Electron binary)
84
# System Electron will be used at runtime via the wrapper script
85
install -dm755 "$pkgdir/opt/mineradio"
86
cp -r dist/linux-unpacked/resources "$pkgdir/opt/mineradio/"
87
88
# Make the wrapper script executable and install it
89
install -Dm755 "$srcdir/mineradio.sh" "$pkgdir/usr/bin/mineradio"
90
91
# Install desktop file
92
install -Dm644 "$srcdir/mineradio.desktop" "$pkgdir/usr/share/applications/mineradio.desktop"
93
94
# Install icon
95
install -Dm644 build/icon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/mineradio.png"
96
}
97
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |