mongreldb-viewer

maintainer visorcraft · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt ONNX Runtime binary from a non-standard, non-whitelisted host (cdn.pyke.io) which could be silently swapped, constituting a supply-chain risk, though it does not execute remote code directly via npx due to --offline flag.

Triggered rules

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:66 npx --offline tauri build --no-bundle

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "onnxruntime-$_ortver-x86_64.tar.lzma2::https://cdn.pyke.io/0/pyke:ort-rs/ms@$_ortver/x86_64-unknown-linux-gnu.tar.lzma2"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt ONNX Runtime binary from a non-standard, non-whitelisted host (cdn.pyke.io) which could be silently swapped, constituting a supply-chain risk, though it does not execute remote code directly via npx due to --offline flag.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: VisorCraft LLC <packages@visorcraft.com>
    
      2# SPDX-FileCopyrightText: 2026 VisorCraft LLC
    
      3# SPDX-License-Identifier: 0BSD
    
      4
    
      5pkgname=mongreldb-viewer
    
      6pkgver=1.6.5
    
      7pkgrel=1
    
      8_ortver=1.24.2
    
      9pkgdesc='Desktop viewer for exploring MongrelDB databases'
    
      10arch=('x86_64')
    
      11url='https://github.com/visorcraft/MongrelDB-Viewer'
    
      12license=('MIT' 'Apache-2.0')
    
      13depends=(
    
      14  'cairo'
    
      15  'dbus'
    
      16  'gcc-libs'
    
      17  'gdk-pixbuf2'
    
      18  'glib2'
    
      19  'glibc'
    
      20  'gtk3'
    
      21  'hicolor-icon-theme'
    
      22  'libsoup3'
    
      23  'openssl'
    
      24  'webkit2gtk-4.1'
    
      25)
    
      26makedepends=('cargo' 'npm' 'pkgconf')
    
      27options=('!lto')
    
      28source=(
    
      29  "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      30  'com.visorcraft.mongreldb-viewer.desktop'
    
      31  "onnxruntime-$_ortver-x86_64.tar.lzma2::https://cdn.pyke.io/0/pyke:ort-rs/ms@$_ortver/x86_64-unknown-linux-gnu.tar.lzma2"
    
      32  "onnxruntime-$_ortver-LICENSE::https://raw.githubusercontent.com/microsoft/onnxruntime/v$_ortver/LICENSE"
    
      33  "onnxruntime-$_ortver-ThirdPartyNotices.txt::https://raw.githubusercontent.com/microsoft/onnxruntime/v$_ortver/ThirdPartyNotices.txt"
    
      34)
    
      35noextract=("onnxruntime-$_ortver-x86_64.tar.lzma2")
    
      36sha256sums=('2ea054d0d6b38db51eee6ab7b06654ae1c3827df8313c32ae90bf816464a64ae'
    
      37            '10e74160895b60fa9efc6ee06d4ff1cec3852d940c4c0c87e60b1bd06a8bff26'
    
      38            'acc1cba79c337594ead1d88ca72516147aa60054c84217b53399a31caa5ba671'
    
      39            '2f07c72751aed99790b8a4869cf2311df85a860b22ded05fa22803587a48922c'
    
      40            '0e07b95f3a8d6230037707c5c4a2b554d12c4cb67369669ac255635528ffcee2')
    
      41
    
      42prepare() {
    
      43  cd "MongrelDB-Viewer-$pkgver"
    
      44  export CARGO_HOME="$srcdir/cargo"
    
      45  export npm_config_cache="$srcdir/npm-cache"
    
      46
    
      47  npm ci
    
      48  install -d "$srcdir/onnxruntime"
    
      49  xz --format=raw --lzma2=dict=64MiB -dc \
    
      50    "$srcdir/onnxruntime-$_ortver-x86_64.tar.lzma2" |
    
      51    bsdtar -xf - -C "$srcdir/onnxruntime"
    
      52  cargo fetch --manifest-path src-tauri/Cargo.toml \
    
      53    --target "$CARCH-unknown-linux-gnu"
    
      54}
    
      55
    
      56build() {
    
      57  cd "MongrelDB-Viewer-$pkgver"
    
      58  export CARGO_HOME="$srcdir/cargo"
    
      59  export CARGO_NET_OFFLINE=true
    
      60  export CARGO_PROFILE_RELEASE_LTO=false
    
      61  export npm_config_cache="$srcdir/npm-cache"
    
      62  export npm_config_offline=true
    
      63  export ORT_LIB_LOCATION="$srcdir/onnxruntime"
    
      64  export RUSTFLAGS="${RUSTFLAGS:-} --remap-path-prefix=$srcdir=/usr/src/debug/$pkgname-$pkgver"
    
      65
    
      66  npx --offline tauri build --no-bundle
    
      67}
    
      68
    
      69package() {
    
      70  cd "MongrelDB-Viewer-$pkgver"
    
      71
    
      72  install -Dm755 src-tauri/target/release/mongreldb-viewer \
    
      73    "$pkgdir/usr/bin/mongreldb-viewer"
    
      74  install -Dm644 "$srcdir/com.visorcraft.mongreldb-viewer.desktop" \
    
      75    "$pkgdir/usr/share/applications/com.visorcraft.mongreldb-viewer.desktop"
    
      76
    
      77  install -Dm644 src-tauri/icons/32x32.png \
    
      78    "$pkgdir/usr/share/icons/hicolor/32x32/apps/com.visorcraft.mongreldb-viewer.png"
    
      79  install -Dm644 src-tauri/icons/64x64.png \
    
      80    "$pkgdir/usr/share/icons/hicolor/64x64/apps/com.visorcraft.mongreldb-viewer.png"
    
      81  install -Dm644 src-tauri/icons/128x128.png \
    
      82    "$pkgdir/usr/share/icons/hicolor/128x128/apps/com.visorcraft.mongreldb-viewer.png"
    
      83  install -Dm644 src-tauri/icons/128x128@2x.png \
    
      84    "$pkgdir/usr/share/icons/hicolor/256x256/apps/com.visorcraft.mongreldb-viewer.png"
    
      85  install -Dm644 src-tauri/icons/icon.png \
    
      86    "$pkgdir/usr/share/icons/hicolor/512x512/apps/com.visorcraft.mongreldb-viewer.png"
    
      87
    
      88  install -Dm644 LICENSE-MIT "$pkgdir/usr/share/licenses/$pkgname/LICENSE-MIT"
    
      89  install -Dm644 LICENSE-APACHE "$pkgdir/usr/share/licenses/$pkgname/LICENSE-APACHE"
    
      90  install -Dm644 "$srcdir/onnxruntime-$_ortver-LICENSE" \
    
      91    "$pkgdir/usr/share/licenses/$pkgname/ONNX-Runtime-LICENSE"
    
      92  install -Dm644 "$srcdir/onnxruntime-$_ortver-ThirdPartyNotices.txt" \
    
      93    "$pkgdir/usr/share/licenses/$pkgname/ONNX-Runtime-ThirdPartyNotices.txt"
    
      94  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      95}
    
      96

Changes since previous scan

--- PKGBUILD @ 2026-07-28 03:37
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: 0BSD
 
 pkgname=mongreldb-viewer
-pkgver=1.6.4
+pkgver=1.6.5
 pkgrel=1
 _ortver=1.24.2
 pkgdesc='Desktop viewer for exploring MongrelDB databases'
@@ -33,7 +33,7 @@
   "onnxruntime-$_ortver-ThirdPartyNotices.txt::https://raw.githubusercontent.com/microsoft/onnxruntime/v$_ortver/ThirdPartyNotices.txt"
 )
 noextract=("onnxruntime-$_ortver-x86_64.tar.lzma2")
-sha256sums=('766822228c4d8ea381b593970eee1066fbf1821990d52b200658030254a62369'
+sha256sums=('2ea054d0d6b38db51eee6ab7b06654ae1c3827df8313c32ae90bf816464a64ae'
             '10e74160895b60fa9efc6ee06d4ff1cec3852d940c4c0c87e60b1bd06a8bff26'
             'acc1cba79c337594ead1d88ca72516147aa60054c84217b53399a31caa5ba671'
             '2f07c72751aed99790b8a4869cf2311df85a860b22ded05fa22803587a48922c'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	4
2026-08-01 00:11:18	MEDIUM	4
2026-07-31 00:14:10	MEDIUM	4
2026-07-30 00:17:23	MEDIUM	4
2026-07-29 00:25:53	MEDIUM	4
2026-07-28 05:37:03	MEDIUM	4
2026-07-28 03:37:00	MEDIUM	4
2026-07-28 00:07:28	MEDIUM	4
2026-07-27 17:35:03	MEDIUM	4
2026-07-27 00:24:32	MEDIUM	4
2026-07-26 23:33:54	MEDIUM	4
2026-07-26 00:07:32	MEDIUM	4
2026-07-25 05:29:17	MEDIUM	4
2026-07-25 00:13:44	MEDIUM	4
2026-07-24 17:28:09	MEDIUM	4
2026-07-24 11:27:50	MEDIUM	4
2026-07-24 00:02:28	MEDIUM	4
2026-07-23 19:25:44	MEDIUM	4
2026-07-23 09:22:54	MEDIUM	4