mineradio-vision-git

LOW

maintainer zxp19821005 0 votes scanned 2026-08-28 11:36:51.139158

View on AUR

Why flagged

The package builds from the project's own git source using bun/electron-builder; the flagged 'bunx electron-builder' runs a locally installed dev dependency (not a remote package), and the CN-region mirror substitution is a common pattern in Chinese-maintained AUR packages rather than malicious redirection. Main concerns are SKIP'd checksum on git source and the ipinfo.io geolocation call, but neither constitutes clear malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The package builds from the project's own git source using bun/electron-builder; the flagged 'bunx electron-builder' runs a locally installed dev dependency (not a remote package), and the CN-region mirror substitution is a common pattern in Chinese-maintained AUR packages rather than malicious redirection. Main concerns are SKIP'd checksum on git source and the ipinfo.io geolocation call, but neither constitutes clear malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:105 bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=mineradio-vision-git
    
      3_pkgname=Mineradio-Vision
    
      4pkgver=3.0.0.r0.gbb899a0
    
      5_electronversion=42
    
      6_nodeversion=24
    
      7pkgrel=1
    
      8pkgdesc="Learning-purpose fork of Mineradio with Kugou/Qishui/Spotify integration, LiquidGlass visuals and modular architecture.(Use system-wide electron)"
    
      9arch=('any')
    
      10url="https://github.com/moli-lihuashi/Mineradio-Vision"
    
      11license=('GPL-3.0-or-later')
    
      12conflicts=("${pkgname%-git}")
    
      13provides=("${pkgname%-git}=${pkgver%.r*}")
    
      14depends=(
    
      15    "electron${_electronversion}"
    
      16)
    
      17makedepends=(
    
      18    'gendesk'
    
      19    'bun'
    
      20    'nvm'
    
      21    'git'
    
      22    'curl'
    
      23    'jq'
    
      24)
    
      25source=(
    
      26    "${pkgname%-git}.git::git+${url}"
    
      27    "${pkgname%-git}.sh"
    
      28)
    
      29sha256sums=('SKIP'
    
      30            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      31pkgver() {
    
      32    cd "${srcdir}/${pkgname%-git}.git"
    
      33    set -o pipefail
    
      34    git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
      35    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      36}
    
      37_ensure_local_nvm() {
    
      38    local NVM_DIR="${srcdir}/.nvm"
    
      39    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      40    nvm install "${_nodeversion}"
    
      41    nvm use "${_nodeversion}"
    
      42}
    
      43_get_app_dir() {
    
      44    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      45}
    
      46_get_electron_version() {
    
      47    _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
    
      48        -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
    
      49    [[ -z "${_elec_ver}" ]] && return 1
    
      50    echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
    
      51}
    
      52_set_build_env() {
    
      53	export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
    
      54    export ELECTRON_OVERRIDE_DIST_PATH="${electronDist}"
    
      55    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      56    export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
      57    export HOME="${srcdir}/.electron-gyp"
    
      58    export CARGO_HOME="${srcdir}/.cargo"
    
      59    if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      60        export BUN_CONFIG_REGISTRY="https://registry.npmmirror.com"
    
      61        export npm_config_registry="https://registry.npmmirror.com"
    
      62        export BUN_INSTALL_DISABLE_DEFAULT_REGISTRY_FALLBACK=1
    
      63        export npm_config_nodejs_org_mirror="https://npmmirror.com/mirrors/node"
    
      64        export NVM_NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
    
      65        export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron"
    
      66        export npm_config_electron_mirror="https://npmmirror.com/mirrors/electron/"
    
      67        export BUN_BINARY_MIRROR_OVERRIDE="https://npmmirror.com/-/binary/"
    
      68        export RUSTUP_DIST_SERVER="https://mirrors.aliyun.com/rustup"
    
      69		export RUSTUP_UPDATE_ROOT="https://mirrors.aliyun.com/rustup/rustup"
    
      70        rm -rf package-lock.json
    
      71    fi
    
      72}
    
      73prepare() {
    
      74    cd "${srcdir}/${pkgname%-git}.git"
    
      75    _get_electron_version
    
      76    sed -i -e "
    
      77        s/@electronversion@/${_electronversion}/g
    
      78        s/@appname@/${pkgname%-git}/g
    
      79        s/@runname@/app.asar/g
    
      80        s/@cfgdirname@/${_pkgname%-Vision}/g
    
      81    " "${srcdir}/${pkgname%-git}.sh"
    
      82    gendesk -q -f -n \
    
      83        --pkgname="${pkgname%-git}" \
    
      84        --pkgdesc="${pkgdesc}" \
    
      85        --categories="Development" \
    
      86        --name="${_pkgname}" \
    
      87        --exec="${pkgname%-git} %U"
    
      88    _set_build_env
    
      89    _ensure_local_nvm
    
      90    sed -i -e "
    
      91        s/\"asar\"\: false\,/\"asar\"\: true\,/g
    
      92        s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g
    
      93    " package.json
    
      94    # Fix Windows-only ANGLE backend (d3d11) for Linux compatibility
    
      95    sed -i "s/\['use-angle', 'd3d11'\]/['use-angle', 'gl']/g" desktop/main.js
    
      96    # Fix Linux taskbar icon: use PNG instead of ICO, and set proper appUserModelId
    
      97    sed -i "s|const APP_ICON_ICO = path.join(__dirname, '..', 'build', 'icon.ico');|const APP_ICON_ICO = path.join(__dirname, '..', 'build', 'icon.png');|g" desktop/main.js
    
      98    sed -i "s/const APP_USER_MODEL_ID = _BETA_META.appUserModelId || 'com.mineradio.desktop';/const APP_USER_MODEL_ID = '${pkgname%-git}';/g" desktop/main.js
    
      99    bun install
    
      100}
    
      101build() {
    
      102    cd "${srcdir}/${pkgname%-git}.git"
    
      103    _set_build_env
    
      104    _ensure_local_nvm
    
      105    bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
    
      106}
    
      107package() {
    
      108    install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
      109    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
    
      110	local _app_dir=$(_get_app_dir)
    
      111	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-git}/"
    
      112    rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
    
      113    install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
      114    install -Dm644 "${srcdir}/${pkgname%-git}.git/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
    
      115    install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      116}
    
      117

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-28 11:36:51	Low	3
2026-08-28 11:35:03	Medium	2