mongreldb-viewer
MEDIUM
maintainer visorcraft
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt ONNX Runtime binary from a non-standard, non-whitelisted host (cdn.pyke.io) which could be silently swapped, constituting a supply-chain risk, though it does not execute remote code directly via npx due to --offline flag.
Triggered rules
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:66
npx --offline tauri build --no-bundle
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:31
"onnxruntime-$_ortver-x86_64.tar.lzma2::https://cdn.pyke.io/0/pyke:ort-rs/ms@$_ortver/x86_64-unknown-linux-gnu.tar.lzma2"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt ONNX Runtime binary from a non-standard, non-whitelisted host (cdn.pyke.io) which could be silently swapped, constituting a supply-chain risk, though it does not execute remote code directly via npx due to --offline flag.
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: VisorCraft LLC <packages@visorcraft.com>
2
# SPDX-FileCopyrightText: 2026 VisorCraft LLC
3
# SPDX-License-Identifier: 0BSD
4
5
pkgname=mongreldb-viewer
6
pkgver=1.6.5
7
pkgrel=1
8
_ortver=1.24.2
9
pkgdesc='Desktop viewer for exploring MongrelDB databases'
10
arch=('x86_64')
11
url='https://github.com/visorcraft/MongrelDB-Viewer'
12
license=('MIT' 'Apache-2.0')
13
depends=(
14
'cairo'
15
'dbus'
16
'gcc-libs'
17
'gdk-pixbuf2'
18
'glib2'
19
'glibc'
20
'gtk3'
21
'hicolor-icon-theme'
22
'libsoup3'
23
'openssl'
24
'webkit2gtk-4.1'
25
)
26
makedepends=('cargo' 'npm' 'pkgconf')
27
options=('!lto')
28
source=(
29
"$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
30
'com.visorcraft.mongreldb-viewer.desktop'
31
"onnxruntime-$_ortver-x86_64.tar.lzma2::https://cdn.pyke.io/0/pyke:ort-rs/ms@$_ortver/x86_64-unknown-linux-gnu.tar.lzma2"
32
"onnxruntime-$_ortver-LICENSE::https://raw.githubusercontent.com/microsoft/onnxruntime/v$_ortver/LICENSE"
33
"onnxruntime-$_ortver-ThirdPartyNotices.txt::https://raw.githubusercontent.com/microsoft/onnxruntime/v$_ortver/ThirdPartyNotices.txt"
34
)
35
noextract=("onnxruntime-$_ortver-x86_64.tar.lzma2")
36
sha256sums=('2ea054d0d6b38db51eee6ab7b06654ae1c3827df8313c32ae90bf816464a64ae'
37
'10e74160895b60fa9efc6ee06d4ff1cec3852d940c4c0c87e60b1bd06a8bff26'
38
'acc1cba79c337594ead1d88ca72516147aa60054c84217b53399a31caa5ba671'
39
'2f07c72751aed99790b8a4869cf2311df85a860b22ded05fa22803587a48922c'
40
'0e07b95f3a8d6230037707c5c4a2b554d12c4cb67369669ac255635528ffcee2')
41
42
prepare() {
43
cd "MongrelDB-Viewer-$pkgver"
44
export CARGO_HOME="$srcdir/cargo"
45
export npm_config_cache="$srcdir/npm-cache"
46
47
npm ci
48
install -d "$srcdir/onnxruntime"
49
xz --format=raw --lzma2=dict=64MiB -dc \
50
"$srcdir/onnxruntime-$_ortver-x86_64.tar.lzma2" |
51
bsdtar -xf - -C "$srcdir/onnxruntime"
52
cargo fetch --manifest-path src-tauri/Cargo.toml \
53
--target "$CARCH-unknown-linux-gnu"
54
}
55
56
build() {
57
cd "MongrelDB-Viewer-$pkgver"
58
export CARGO_HOME="$srcdir/cargo"
59
export CARGO_NET_OFFLINE=true
60
export CARGO_PROFILE_RELEASE_LTO=false
61
export npm_config_cache="$srcdir/npm-cache"
62
export npm_config_offline=true
63
export ORT_LIB_LOCATION="$srcdir/onnxruntime"
64
export RUSTFLAGS="${RUSTFLAGS:-} --remap-path-prefix=$srcdir=/usr/src/debug/$pkgname-$pkgver"
65
66
npx --offline tauri build --no-bundle
67
}
68
69
package() {
70
cd "MongrelDB-Viewer-$pkgver"
71
72
install -Dm755 src-tauri/target/release/mongreldb-viewer \
73
"$pkgdir/usr/bin/mongreldb-viewer"
74
install -Dm644 "$srcdir/com.visorcraft.mongreldb-viewer.desktop" \
75
"$pkgdir/usr/share/applications/com.visorcraft.mongreldb-viewer.desktop"
76
77
install -Dm644 src-tauri/icons/32x32.png \
78
"$pkgdir/usr/share/icons/hicolor/32x32/apps/com.visorcraft.mongreldb-viewer.png"
79
install -Dm644 src-tauri/icons/64x64.png \
80
"$pkgdir/usr/share/icons/hicolor/64x64/apps/com.visorcraft.mongreldb-viewer.png"
81
install -Dm644 src-tauri/icons/128x128.png \
82
"$pkgdir/usr/share/icons/hicolor/128x128/apps/com.visorcraft.mongreldb-viewer.png"
83
install -Dm644 src-tauri/icons/128x128@2x.png \
84
"$pkgdir/usr/share/icons/hicolor/256x256/apps/com.visorcraft.mongreldb-viewer.png"
85
install -Dm644 src-tauri/icons/icon.png \
86
"$pkgdir/usr/share/icons/hicolor/512x512/apps/com.visorcraft.mongreldb-viewer.png"
87
88
install -Dm644 LICENSE-MIT "$pkgdir/usr/share/licenses/$pkgname/LICENSE-MIT"
89
install -Dm644 LICENSE-APACHE "$pkgdir/usr/share/licenses/$pkgname/LICENSE-APACHE"
90
install -Dm644 "$srcdir/onnxruntime-$_ortver-LICENSE" \
91
"$pkgdir/usr/share/licenses/$pkgname/ONNX-Runtime-LICENSE"
92
install -Dm644 "$srcdir/onnxruntime-$_ortver-ThirdPartyNotices.txt" \
93
"$pkgdir/usr/share/licenses/$pkgname/ONNX-Runtime-ThirdPartyNotices.txt"
94
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
95
}
96
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 3 |
| 2026-09-16 00:03:17 | Medium | 3 |
| 2026-09-15 00:25:31 | Medium | 3 |
| 2026-09-14 00:27:57 | Medium | 3 |
| 2026-09-13 00:19:54 | Medium | 3 |
| 2026-09-12 00:25:17 | Medium | 3 |
| 2026-09-11 00:19:22 | Medium | 3 |
| 2026-09-10 00:22:44 | Medium | 3 |
| 2026-09-09 00:04:09 | Medium | 3 |
| 2026-09-08 00:18:08 | Medium | 3 |
| 2026-09-07 00:30:15 | Medium | 3 |
| 2026-09-06 00:17:06 | Medium | 3 |
| 2026-09-05 00:16:27 | Medium | 3 |
| 2026-09-04 00:03:13 | Medium | 3 |
| 2026-09-03 00:15:47 | Medium | 3 |
| 2026-09-02 00:02:31 | Medium | 3 |
| 2026-09-01 00:11:19 | Medium | 3 |
| 2026-08-31 00:19:57 | Medium | 3 |
| 2026-08-30 00:04:14 | Medium | 3 |
| 2026-08-29 00:29:17 | Medium | 3 |