mtgaprotracker

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD fetches source from the official GitHub repository with pinned SHA256 checksums, which is standard practice. The 'yarn add @electron-forge/cli' and 'yarn add @electron-forge/plugin-webpack' calls during prepare() do pull packages from the npm registry that aren't pinned in a lockfile committed to the source tarball, which is a mild supply-chain concern. However, these are well-known, widely-used official electron-forge packages maintained by the Electron project itself (published under the @electron-forge scope), not personal or unofficial packages. This is a common pattern in AUR PKGBUILDs for Electron apps where build tooling needs to be added. The risk is the same as any 'yarn install' without a lockfile — npm registry compromise or package hijacking — but this applies equally to the main 'yarn install' call and is a general AUR/npm ecosystem concern rather than a specific red flag. The packages themselves are legitimate build tools, not runtime dependencies that get bundled into the final package in an opaque way. This is sloppy packaging (should pin versions or use a lockfile) but not a meaningful elevation above the baseline risk of any npm-based AUR package.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The PKGBUILD fetches source from the official GitHub repository with pinned SHA256 checksums, which is standard practice. The 'yarn add @electron-forge/cli' and 'yarn add @electron-forge/plugin-webpack' calls during prepare() do pull packages from the npm registry that aren't pinned in a lockfile committed to the source tarball, which is a mild supply-chain concern. However, these are well-known, widely-used official electron-forge packages maintained by the Electron project itself (published under the @electron-forge scope), not personal or unofficial packages. This is a common pattern in AUR PKGBUILDs for Electron apps where build tooling needs to be added. The risk is the same as any 'yarn install' without a lockfile — npm registry compromise or package hijacking — but this applies equally to the main 'yarn install' call and is a general AUR/npm ecosystem concern rather than a specific red flag. The packages themselves are legitimate build tools, not runtime dependencies that get bundled into the final package in an opaque way. This is sloppy packaging (should pin versions or use a lockfile) but not a meaningful elevation above the baseline risk of any npm-based AUR package.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:33 yarn add @electron-forge/cli
PKGBUILD:34 yarn add @electron-forge/plugin-webpack

PKGBUILD

2 offending line(s) highlighted

      1pkgname=mtgaprotracker
    
      2_pkgname=mtgap
    
      3pkgver=2.0.49
    
      4pkgrel=1
    
      5pkgdesc="Automatically uploads collection, decks, battles, draft and inventory from your Magic: The Gathering Arena client"
    
      6
    
      7arch=('i686' 'x86_64')
    
      8license=('MIT')
    
      9depends=('electron')
    
      10makedepends=('yarn' 'npm')
    
      11source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Razviar/mtgap/archive/v${pkgver}.tar.gz"
    
      12	"runmtgap.sh" 
    
      13	"${_pkgname}.desktop"
    
      14	"home.html.patch"
    
      15	"ipc_main.ts.patch"
    
      16	"main_window.ts.patch")
    
      17sha256sums=('504b7dd11ed0af23c397cad454bf0c80988ea748ef067889ac7c633f70dfbd3d' 
    
      18	    '93dfa25b7da8394dce436a67b600bc06bb7576daa62bdabe6e48f2bf8c9e1436'
    
      19	    '145aa9f5ccb104f5b93cccbe5221755299abcdf02d4cd4d635e5038bfca63048'
    
      20	    '5edc0ef1c18ee3f92487024460a60193834bb2fdd23b1f7b03d0acdd460f41a3'
    
      21	    '5aa2cb1d6d6fda1cb8be156f7a1e7419c5f14b7693a30d069201558689787e2c'
    
      22	    '424fc6ae2b2c824744c25e02f58ac0ec6f63f43c168e022dccd75d8974eb7643')
    
      23
    
      24prepare() {
    
      25  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      26
    
      27  # Set system Electron version for ABI compatibility
    
      28  sed -r 's#("electron": ").*"#\1'$(cat /usr/lib/electron/version)'"#' -i package.json
    
      29
    
      30  # Allow higher Node versions
    
      31  sed 's#"node": "#&>=#' -i package.json
    
      32  yarn install
    
      33  yarn add @electron-forge/cli
    
      34  yarn add @electron-forge/plugin-webpack
    
      35  patch -u src/windows/home/home.html < "${srcdir}/home.html.patch"
    
      36  patch -u src/app/ipc_main.ts < "${srcdir}/ipc_main.ts.patch"
    
      37  patch -u src/app/main_window.ts < "${srcdir}/main_window.ts.patch"
    
      38  
    
      39
    
      40}
    
      41
    
      42build(){
    
      43	cd "${srcdir}/${_pkgname}-${pkgver}"
    
      44	yarn run package 
    
      45}
    
      46
    
      47package(){
    
      48	cd "${srcdir}/${_pkgname}-${pkgver}/out"
    
      49
    
      50	case "$CARCH" in
    
      51	'x86_64')
    
      52		_dir_arch='x64'
    
      53		;;
    
      54	'i686')
    
      55		_dir_arch='i386'
    
      56		;;
    
      57	*)
    
      58		_dir_arch=$CARCH
    
      59		;;
    
      60	esac
    
      61	mkdir -p "${pkgdir}/opt/"
    
      62	cp -a "${pkgname}-linux-${_dir_arch}" "${pkgdir}/opt/"
    
      63
    
      64	#Dirty Workaround for logging. Should likely go somewhere else.
    
      65	mkdir -p "${pkgdir}/opt/${pkgname}-linux-${_dir_arch}/undefined/MTGAproTracker"
    
      66	chgrp users -R "${pkgdir}/opt/${pkgname}-linux-${_dir_arch}/undefined"
    
      67	chmod 775 -R "${pkgdir}/opt/${pkgname}-linux-${_dir_arch}/undefined"
    
      68
    
      69	install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/src/statics/icon.ico" "${pkgdir}/usr/share/icons/${_pkgname}.ico"
    
      70	install -Dm644 "${srcdir}/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      71	install -Dm755 "${srcdir}/runmtgap.sh" "${pkgdir}/usr/bin/mtgap"
    
      72}
    
      73
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2