musicfree-desktop-git

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The `npm add -D @electron-forge/plugin-local-electron` installs a well-known, official Electron Forge plugin from the npm registry. This is a legitimate, widely-used package maintained by the Electron Forge team (part of the electron-userland organization). It is being installed as a devDependency specifically to enable building against the system-installed Electron rather than downloading a bundled one — a common pattern in AUR PKGBUILDs that patch apps to use system Electron. While it is an undeclared external package not listed in the upstream package.json, it is not from an unofficial or personal host, and it is not executed at runtime. The supply-chain risk is the same as any other npm package install during build, which is standard practice. The PKGBUILD also uses nvm to manage Node versions and checks for CN geolocation to switch mirrors, which are unusual but not malicious patterns. Overall this is sloppy/non-standard packaging (undeclared build dependency, runtime geolocation check) but not a genuine security concern.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The `npm add -D @electron-forge/plugin-local-electron` installs a well-known, official Electron Forge plugin from the npm registry. This is a legitimate, widely-used package maintained by the Electron Forge team (part of the electron-userland organization). It is being installed as a devDependency specifically to enable building against the system-installed Electron rather than downloading a bundled one — a common pattern in AUR PKGBUILDs that patch apps to use system Electron. While it is an undeclared external package not listed in the upstream package.json, it is not from an unofficial or personal host, and it is not executed at runtime. The supply-chain risk is the same as any other npm package install during build, which is standard practice. The PKGBUILD also uses nvm to manage Node versions and checks for CN geolocation to switch mirrors, which are unusual but not malicious patterns. Overall this is sloppy/non-standard packaging (undeclared build dependency, runtime geolocation check) but not a genuine security concern.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:85 NODE_ENV=development npm add -D @electron-forge/plugin-local-electron

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=musicfree-desktop-git
    
      3_pkgname=MusicFreeDesktop
    
      4pkgver=0.0.8.r4.gf3b526a
    
      5_electronversion=25
    
      6_nodeversion=20
    
      7pkgrel=1
    
      8pkgdesc="Plug-in, customized, ad-free music player.(Use system-wide electron)插件化、定制化、无广告的免费音乐播放器"
    
      9arch=('any')
    
      10url="https://musicfree.catcat.work/"
    
      11_ghurl="https://github.com/maotoumao/MusicFreeDesktop"
    
      12_pluginurl="https://gitee.com/maotoumao/MusicFreePlugins/raw/master/plugins.json"
    
      13license=('GPL-3.0-only')
    
      14conflicts=("${pkgname%-git}")
    
      15depends=(
    
  "electron${_electronversion}"
    
  'libvips'
    
      18)
    
      19makedepends=(
    
  'gendesk'
    
  'npm'
    
  'nvm'
    
  'git'
    
  'curl'
    
  'jq'
    
      26)
    
      27source=(
    
  "${pkgname%-git}.git::git+${_ghurl}.git"
    
  "${pkgname%-git}.sh"
    
      30)
    
      31options=(
    
  '!emptydirs'
    
      33)
    
      34sha256sums=('SKIP'
    
          '31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
    
      36pkgver() {
    
  cd "${srcdir}/${pkgname%-git}.git"
    
  set -o pipefail
    
  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      41}
    
      42_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      47}
    
      48_get_electron_version() {
    
  _elec_ver=$(jq -r '.devDependencies["electron"] // .dependencies["electron"]' "${srcdir}/${pkgname%-git}.git/package.json" | tr -d '^')
    
  _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
    
  echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
    
      52}
    
      53prepare() {
    
  cd "${srcdir}/${pkgname%-git}.git"
    
  _get_electron_version
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname%-git}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${_pkgname%Desktop}/g
    
      s/@options@//g
    
  " "${srcdir}/${pkgname%-git}.sh"
    
  gendesk -f -q -n \
    
      --pkgname="${pkgname%-git}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="AudioVideo" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname%-git} %U"
    
  export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  local HOME="${srcdir}/.electron-gyp"
    
  export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
    
  export NPM_CONFIG_MAXSOCKETS=32
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      {
    
          export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
    
          export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
    
          export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
    
      }
    
      find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
    
  fi
    
  _ensure_local_nvm
    
  find src -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  NODE_ENV=development    npm install --legacy-peer-deps
    
  NODE_ENV=development    npm add -D @electron-forge/plugin-local-electron
    
      86}
    
      87build() {
    
  cd "${srcdir}/${pkgname%-git}.git"
    
  _ensure_local_nvm
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  local electronDist="/usr/lib/electron${_electronversion}"
    
  sed -i -e "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
    
  {\\
    
      name: \"@electron-forge/plugin-local-electron\",\\
    
      config: {\\
    
          electronPath: \"${electronDist}\"\\
    
      }\\
    
  }," forge.config.ts
    
  NODE_ENV=production     npm run package
    
  find "${srcdir}/${pkgname%-git}.git/out/${_pkgname%Desktop}-linux-"*"/resources/app/node_modules" -type d \( -name "darwin-*" -o -name "win32-*" \) -exec rm -rf {} +
    
  case "${CARCH}" in
    
      aarch64)
    
          find "${srcdir}/${pkgname%-git}.git/out/${_pkgname%Desktop}-linux-"*"/resources/app/node_modules" -type d -name "linux-x64" -exec rm -rf {} +
    
          ;;
    
      x86_64)
    
          find "${srcdir}/${pkgname%-git}.git/out/${_pkgname%Desktop}-linux-"*"/resources/app/node_modules" -type d -name "linux-arm64" -exec rm -rf {} +
    
          ;;
    
  esac
    
      109}
    
      110package() {
    
  install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
    
find "${srcdir}/${pkgname%-git}.git/out/${_pkgname%Desktop}-linux-"*"/resources" -maxdepth 1 -type f -exec install -Dm644 -t "${pkgdir}/usr/lib/${pkgname%-git}" {} +
    
  if find "${srcdir}/${pkgname%-git}.git/out/${_pkgname%Desktop}-linux-"*"/resources" -mindepth 1 -maxdepth 1 -type d | read; then
    
      for _subdir in "${srcdir}/${pkgname%-git}.git/out/${_pkgname%Desktop}-linux-"*"/resources/"*; do
    
          if [ -d "${_subdir}" ]; then
    
              cp -Pr --no-preserve=ownership "${_subdir}" "${pkgdir}/usr/lib/${pkgname%-git}"
    
          fi
    
      done
    
  fi
    
  install -Dm644 "${srcdir}/${pkgname%-git}.git/res/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
    
  install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
      123}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2