moekoemusic

LOW
maintainer zxp19821005 0 votes scanned 2026-11-06 06:11:22.019786
View on AUR
Why flagged

The package builds from a legitimate source on GitHub, uses standard Node.js tooling, and installs dependencies via pnpm from npmjs.org; the variable-named package install is part of normal project dependency resolution and not malicious.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a legitimate source on GitHub, uses standard Node.js tooling, and installs dependencies via pnpm from npmjs.org; the variable-named package install is part of normal project dependency resolution and not malicious.

  • PKGBUILD:98 npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=moekoemusic
3_pkgname='MoeKoe Music'
4_zhsname='萌音'
5pkgver=1.7.2
6_electronversion=42
7_nodeversion=24
8pkgrel=1
9pkgdesc="An open-source, concise, and aesthetically pleasing third-party client for KuGou.一款开源简洁高颜值的酷狗第三方客户端"
10arch=(
11 'aarch64'
12 'x86_64'
13)
14url="https://music.moekoe.cn/"
15_ghurl="https://github.com/MoeKoeMusic/MoeKoeMusic"
16license=('GPL-2.0-only')
17depends=(
18 "electron${_electronversion}"
19)
20makedepends=(
21 'npm'
22 'pnpm'
23 'nvm'
24 'git'
25 'gendesk'
26 'jq'
27)
28source=(
29 "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/v${pkgver}.tar.gz"
30 "${pkgname}.js"
31 "${pkgname}.sh"
32)
33sha256sums=('8c267dddaf3cc4bb04e196ded3a4fe70b7c99a1155413d6b66637aa6a1ae35e5'
34 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
35 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
36_get_project_dir() {
37 local d
38 while IFS= read -r d; do
39 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
40 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
41}
42_ensure_local_nvm() {
43 local NVM_DIR="${srcdir}/.nvm"
44 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
45 nvm install "${_nodeversion}"
46 nvm use "${_nodeversion}"
47}
48_get_app_dir() {
49 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
50 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
51}
52_get_electron_version() {
53 local _v
54 _v=$(jq -r '.. | (.electron? // empty) | strings | select(test("^[0-9]"))' "$(_get_project_dir)/package.json" 2>/dev/null | head -1)
55 [[ -z "$_v" ]] && _v=$(grep -oE 'electron@[0-9.]+' "$(_get_project_dir)/pnpm-lock.yaml" 2>/dev/null | head -1 | sed 's/^electron@//')
56 [[ -z "$_v" ]] && _v=$(grep -oE 'electron@npm:[0-9.]+' "$(_get_project_dir)/yarn.lock" 2>/dev/null | head -1 | sed 's/^electron@npm://')
57 [[ -z "$_v" ]] && _v=$(jq -r '.packages["node_modules/electron"].version // empty' "$(_get_project_dir)/package-lock.json" 2>/dev/null | head -1)
58 [[ -z "$_v" ]] && _v=$(grep -oE 'electron: ?\[?"?npm:?[0-9.]+' "$(_get_project_dir)/bun.lock" 2>/dev/null | grep -oE '[0-9.]+' | head -1)
59 [[ -z "$_v" ]] && return 1
60 _v="${_v%%.*}"
61 (( ${_v} == _electronversion )) && echo -e "\033[1;32mElectron version: ${_v}\033[0m" || echo -e "\033[1;31mElectron version: ${_v} (expected ${_electronversion})\033[0m"
62}
63_set_electron_build_env() {
64 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
65 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
66 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
67 export ELECTRON_BUILDER_OFFLINE=true
68 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
69}
70_set_pnpm_build_env() {
71 export HOME="${srcdir}/.home"
72 export XDG_CACHE_HOME="${HOME}/.cache"
73 export XDG_CONFIG_HOME="${HOME}/.config"
74 export XDG_DATA_HOME="${HOME}/.local/share"
75 export XDG_STATE_HOME="${HOME}/.local/state"
76 export PNPM_HOME="${HOME}/.pnpm/bin"
77 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
78 export pnpm_config_store_dir="${HOME}/.pnpm_store"
79 export pnpm_config_global_dir="${HOME}/.pnpm/global"
80 export pnpm_config_state_dir="${HOME}/.pnpm/state"
81 export pnpm_config_node_linker=hoisted
82 export pnpm_config_minimum_release_age=0
83 export pnpm_config_update_notifier=false
84 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
85 export COREPACK_HOME="${HOME}/.corepack"
86 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
87 export PATH="${PNPM_HOME}:${PATH}"
88 local _detected=""
89 local _pkgjson="$(_get_project_dir)/package.json"
90 if [ -f "${_pkgjson}" ]; then
91 _detected="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
92 if [ -z "${_detected}" ]; then
93 _detected="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
94 fi
95 fi
96 local _ver="${_pnpmver:-${_detected}}"
97 if [ -n "${_ver}" ]; then
98 npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \
99 --registry "${COREPACK_NPM_REGISTRY}"
100 fi
101}
102prepare() {
103 cd "$(_get_project_dir)"
104 _get_electron_version
105 sed -i -e "
106 s/@electronversion@/${_electronversion}/g
107 s/@appname@/${pkgname}/g
108 " "${srcdir}/${pkgname}.sh" "${srcdir}/${pkgname}.js"
109 gendesk -q -f -n \
110 --pkgname="${pkgname}" \
111 --pkgdesc="${pkgdesc}" \
112 --categories="AudioVideo" \
113 --name="${_pkgname}" \
114 --exec="${pkgname} %U" \
115 --custom=Name[zh_CN]="${_zhsname}"
116 _ensure_local_nvm
117 _set_electron_build_env
118 _set_pnpm_build_env
119 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
120 sed -i "s/icon\.ico/icon\.png/g" electron/appServices.js
121 export NODE_ENV=development
122 pnpm install
123}
124build() {
125 cd "$(_get_project_dir)"
126 _ensure_local_nvm
127 _set_electron_build_env
128 _set_pnpm_build_env
129 export NODE_ENV=production
130 pnpm run build
131 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
132 rm -rf "$(_get_app_dir)/resources/default_app.asar"
133}
134package() {
135 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
136 install -Dm644 "${srcdir}/${pkgname}.js" -t "${pkgdir}/usr/lib/${pkgname}"
137 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
138 cp -a "$(_get_app_dir)/assets" "${pkgdir}/usr/lib/${pkgname}"
139 install -Dm644 "$(_get_project_dir)/build/icons/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
140 install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
141}
142

Changes since previous scan

--- PKGBUILD @ 2026-10-14 07:19
+++ PKGBUILD @ 2026-11-06 06:11
@@ -2,9 +2,9 @@
pkgname=moekoemusic
_pkgname='MoeKoe Music'
_zhsname='萌音'
-pkgver=1.7.1
-_electronversion=39
-_nodeversion=22
+pkgver=1.7.2
+_electronversion=42
+_nodeversion=24
pkgrel=1
pkgdesc="An open-source, concise, and aesthetically pleasing third-party client for KuGou.一款开源简洁高颜值的酷狗第三方客户端"
arch=(
@@ -27,13 +27,12 @@
)
source=(
"${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/v${pkgver}.tar.gz"
- "api.tar.gz::https://github.com/MakcRe/KuGouMusicApi/archive/refs/heads/main.tar.gz"
+ "${pkgname}.js"
"${pkgname}.sh"
)
-noextract=('api.tar.gz')
-sha256sums=('68031a5e01a11825567afad2f4894ad29e7dad5e8380f99ea174ba8fa49d809d'
- 'e5e02eca8a627033a7f517148c5c26286fa8648e897ef6791b54019423866ab3'
- 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
+sha256sums=('8c267dddaf3cc4bb04e196ded3a4fe70b7c99a1155413d6b66637aa6a1ae35e5'
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
_get_project_dir() {
local d
while IFS= read -r d; do
@@ -51,29 +50,54 @@
| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_get_electron_version() {
- _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
- | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
- | grep -oE '[0-9]+' | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- (( _elec_ver == _electronversion )) && c=32 || c=31
- echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
+ local _v
+ _v=$(jq -r '.. | (.electron? // empty) | strings | select(test("^[0-9]"))' "$(_get_project_dir)/package.json" 2>/dev/null | head -1)
+ [[ -z "$_v" ]] && _v=$(grep -oE 'electron@[0-9.]+' "$(_get_project_dir)/pnpm-lock.yaml" 2>/dev/null | head -1 | sed 's/^electron@//')
+ [[ -z "$_v" ]] && _v=$(grep -oE 'electron@npm:[0-9.]+' "$(_get_project_dir)/yarn.lock" 2>/dev/null | head -1 | sed 's/^electron@npm://')
+ [[ -z "$_v" ]] && _v=$(jq -r '.packages["node_modules/electron"].version // empty' "$(_get_project_dir)/package-lock.json" 2>/dev/null | head -1)
+ [[ -z "$_v" ]] && _v=$(grep -oE 'electron: ?\[?"?npm:?[0-9.]+' "$(_get_project_dir)/bun.lock" 2>/dev/null | grep -oE '[0-9.]+' | head -1)
+ [[ -z "$_v" ]] && return 1
+ _v="${_v%%.*}"
+ (( ${_v} == _electronversion )) && echo -e "\033[1;32mElectron version: ${_v}\033[0m" || echo -e "\033[1;31mElectron version: ${_v} (expected ${_electronversion})\033[0m"
}
-_set_build_env() {
+_set_electron_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
export ELECTRON_BUILDER_OFFLINE=true
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+}
+_set_pnpm_build_env() {
export HOME="${srcdir}/.home"
export XDG_CACHE_HOME="${HOME}/.cache"
export XDG_CONFIG_HOME="${HOME}/.config"
export XDG_DATA_HOME="${HOME}/.local/share"
- export npm_config_cache="${HOME}/.npm_cache"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
export COREPACK_HOME="${HOME}/.corepack"
- export npm_config_audit=false
- export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
- mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _detected=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _detected="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_detected}" ]; then
+ _detected="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ local _ver="${_pnpmver:-${_detected}}"
+ if [ -n "${_ver}" ]; then
+ npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
prepare() {
cd "$(_get_project_dir)"
@@ -81,7 +105,7 @@
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname}/g
- " "${srcdir}/${pkgname}.sh"
+ " "${srcdir}/${pkgname}.sh" "${srcdir}/${pkgname}.js"
gendesk -q -f -n \
--pkgname="${pkgname}" \
--pkgdesc="${pkgdesc}" \
@@ -90,37 +114,29 @@
--exec="${pkgname} %U" \
--custom=Name[zh_CN]="${_zhsname}"
_ensure_local_nvm
- _set_build_env
+ _set_electron_build_env
+ _set_pnpm_build_env
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
- sed -i -e "
- s/icon\.ico/icon\.png/g
- s/process.resourcesPath/\'\/usr\/lib\/${pkgname}\'/g
- s/\.\.\/api/\.\/api/g
- " electron/appServices.js
- bsdtar -xf "${srcdir}/api.tar.gz" --strip-components=1 -C api
+ sed -i "s/icon\.ico/icon\.png/g" electron/appServices.js
export NODE_ENV=development
- npm install
- cd "$(_get_project_dir)/api"
- npm install
+ pnpm install
}
build() {
cd "$(_get_project_dir)"
_ensure_local_nvm
- _set_build_env
+ _set_electron_build_env
+ _set_pnpm_build_env
export NODE_ENV=production
- npm run build
- case "${CARCH}" in
- aarch64) npm run build:api:linux-aarch64 ;;
- x86_64) npm run build:api:linux ;;
- esac
- npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
+ pnpm run build
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
- install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
+ install -Dm644 "${srcdir}/${pkgname}.js" -t "${pkgdir}/usr/lib/${pkgname}"
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
- cp -a "$(_get_app_dir)"/{api,assets} "${pkgdir}/usr/lib/${pkgname}"
+ cp -a "$(_get_app_dir)/assets" "${pkgdir}/usr/lib/${pkgname}"
install -Dm644 "$(_get_project_dir)/build/icons/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-11-06 06:11:22 Low 1
2026-10-14 07:19:30 Clean 0
2026-08-27 03:31:49 Clean 0
2026-07-21 03:15:42 Clean 0
2026-07-09 03:30:04 Clean 0
2026-07-01 04:40:17 Clean 0
2026-06-22 08:12:41 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion