mkeditor

LOW

maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx usage in the build step is part of building the project from its own source code fetched from the official GitHub repository, which is a normal and legitimate use; the package does not execute arbitrary remote code or introduce untrusted prebuilt binaries.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx usage in the build step is part of building the project from its own source code fetched from the official GitHub repository, which is a normal and legitimate use; the package does not execute arbitrary remote code or introduce untrusted prebuilt binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:89 NODE_ENV=production npx tsc src/app/*.ts --outDir ./dist/app

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=mkeditor
    
      3_pkgname=MKEditor
    
      4pkgver=4.1.0
    
      5_electronversion=42
    
      6_nodeversion=22
    
      7pkgrel=1
    
      8pkgdesc="The simple markdown editor.(Use system-wide electron)"
    
      9arch=('any')
    
      10url="https://versyxdigital.github.io/mkeditor"
    
      11_ghurl="https://github.com/versyxdigital/mkeditor"
    
      12license=("MIT")
    
      13depends=(
    
  "electron${_electronversion}"
    
      15)
    
      16makedepends=(
    
  'npm'
    
  'git'
    
  'nvm'
    
  'gendesk'
    
  'gcc'
    
  'cmake'
    
  'curl'
    
  'jq'
    
      25)
    
      26source=(
    
  "${pkgname}-${pkgver}::git+${_ghurl}#tag=v${pkgver}"
    
  "${pkgname}.sh"
    
      29)
    
      30sha256sums=('5c9fdf652de7205a6d17f07d1bfbc1399f6a82a80d0ec861e0237a62713a1b8b'
    
          'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      32_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      37}
    
      38_get_electron_version() {
    
  _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
    
      -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
    
  [[ -z "${_elec_ver}" ]] && return 1
    
  echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
    
      43}
    
      44prepare() {
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  _get_electron_version
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${_pkgname}/g
    
  " -i "${srcdir}/${pkgname}.sh"
    
  gendesk -q -f -n \
    
      --pkgname="${pkgname}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="Utility" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname} %U"
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
local HOME="${srcdir}/.electron-gyp"
    
export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
    
export NPM_CONFIG_MAXSOCKETS=32
    
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
{
    
	export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
    
	export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
    
	export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
    
	export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
    
	export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
    
	export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
    
}
    
find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
    
fi
    
  _ensure_local_nvm
    
  find src -type f -exec sed -i "s/icon\.ico/icon\.png/g" {} +
    
  sed -e "
    
      s/\/\${platform}\/\${arch}//g
    
      s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g
    
  " -i package.json
    
  rm -rf dist releases
    
  NODE_ENV=development    npm install
    
      83}
    
      84build() {
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  _ensure_local_nvm
    
  NODE_ENV=production     npm run build-editor
    
  NODE_ENV=production     npm run build-app
    
  NODE_ENV=production     npx tsc src/app/*.ts --outDir ./dist/app
    
  cp src/app/assets/icon.png dist/app/assets/
    
  local electronDist="/usr/lib/electron${_electronversion}"
    
  NODE_ENV=production     npm exec -c "electron-builder --linux dir -c.electronDist=${electronDist}"
    
      93}
    
      94package() {
    
  install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
    
  local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -exec dirname {} + | head -n 1)
    
  cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname}/"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/build/resources/icon256x256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/build/resources/icon512x512.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      103}
    
      104

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2