mustang

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged pattern involves yarn install commands, but these are for building the project from its own source code cloned from the official GitHub repository, using locked dependencies via yarn.lock; the installs are part of a standard build process, not arbitrary external package injection.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves yarn install commands, but these are for building the project from its own source code cloned from the official GitHub repository, using locked dependencies via yarn.lock; the installs are part of a standard build process, not arbitrary external package injection.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:103 NODE_ENV=development yarn add -D semver

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=mustang
    
      3_pkgname=Mustang
    
      4pkgver=0.9.34
    
      5_electronversion=41
    
      6_nodever=24
    
      7pkgrel=1
    
      8pkgdesc="New full-featured desktop email, chat and video conference client.(Use system-wide electron)"
    
      9arch=('any')
    
      10url="https://mustang.im/"
    
      11_ghurl="https://github.com/mustang-im/mustang"
    
      12license=('EUPL-1.2')
    
      13depends=(
    
  "electron${_electronversion}"
    
      15)
    
      16makedepends=(
    
  'npm'
    
  'nvm'
    
  'curl'
    
  'gendesk'
    
  'git'
    
  'yarn'
    
  'jq'
    
      24)
    
      25source=("${pkgname}.sh")
    
      26sha256sums=('a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      27_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodever}"
    
  nvm use "${_nodever}"
    
      32}
    
      33_get_app_dir() {
    
  find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      35}
    
      36_set_build_env() {
    
  export electronDist="/usr/lib/electron${_electronversion}"
    
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
export HOME="${srcdir}/.electron-gyp"
    
mkdir -p "${srcdir}/.electron-gyp"
    
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
{
    
	export YARN_REGISTRY="https://registry.npmmirror.com"
    
	export ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
    
	export ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
    
	export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
    
	export YARN_CACHE_FOLDER="${srcdir}/.yarn/cache"
    
	export YARN_PLUGINS_FOLDER="${srcdir}/.yarn/plugins"
    
	export YARN_GLOBAL_FOLDER="${srcdir}/.yarn/global"
    
	export YARN_USE_HARDLINKS=true
    
	# export YARN_BUILD_FROM_SOURCE=true
    
	export YARN_LINK_WORKSPACE_PACKAGES=true
    
	export YARN_FETCH_RETRIES=3
    
	export YARN_FETCH_RETRY_TIMEOUT=10000
    
	export YARN_NETWORK_CONCURRENCY=32
    
}
    
find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g" {} +
    
fi
    
      60}
    
      61_get_electron_version() {
    
  _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
    
      -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
    
  [[ -z "${_elec_ver}" ]] && return 1
    
  echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
    
      66}
    
      67prepare() {
    
  cd "${srcdir}"
    
  if [[ ! -d "${srcdir}/${pkgname}-${pkgver}" ]]; then
    
      git clone \
    
          --depth 1 \
    
          --branch "v${pkgver}" \
    
          "${_ghurl}" \
    
          "${pkgname}-${pkgver}"
    
  fi
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  _get_electron_version
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${pkgname}/g
    
  " "${srcdir}/${pkgname}.sh"
    
  gendesk -q -f -n \
    
      --pkgname="${pkgname}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="Network" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname} %U"
    
  _set_build_env
    
  _ensure_local_nvm
    
  cd "${srcdir}/${pkgname}-${pkgver}/app/build"
    
  sh "${pkgname}-brand.sh"
    
  cd "${srcdir}/${pkgname}-${pkgver}/app"
    
  NODE_ENV=development    yarn install --cache-folder "${srcdir}/.yarn_cache"
    
  cd "${srcdir}/${pkgname}-${pkgver}/lib"
    
  NODE_ENV=development    yarn install --cache-folder "${srcdir}/.yarn_cache"
    
  cd "${srcdir}/${pkgname}-${pkgver}/desktop"
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  NODE_ENV=development    yarn install --cache-folder "${srcdir}/.yarn_cache"
    
  cd "${srcdir}/${pkgname}-${pkgver}/desktop/backend"
    
  NODE_ENV=development    yarn install --cache-folder "${srcdir}/.yarn_cache"
    
  NODE_ENV=development    yarn add -D semver
    
      104}
    
      105build() {
    
  cd "${srcdir}/${pkgname}-${pkgver}/desktop"
    
  _set_build_env
    
  _ensure_local_nvm
    
  NODE_OPTIONS="--max-old-space-size=4096" NODE_ENV=production     yarn run build
    
  NODE_ENV=production     yarn electron-builder --linux dir -c.electronDist="${electronDist}" --config electron-builder.yml
    
  local _app_dir=$(_get_app_dir)
    
  find "${_app_dir}/resources/app.asar.unpacked" -type d \( -name "darwin-*" -o -name "win32-*" \) -exec rm -rf {} +
    
      113}
    
      114package() {
    
  install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
    
  local _app_dir=$(_get_app_dir)
    
  cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/desktop/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      122}
    
      123

Changes since previous scan

--- PKGBUILD @ 2026-07-20 00:19
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
 pkgname=mustang
 _pkgname=Mustang
-pkgver=0.9.33
+pkgver=0.9.34
 _electronversion=41
 _nodever=24
 pkgrel=1

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 11:14:00	MEDIUM	1
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 01:53:03	MEDIUM	1
2026-07-17 00:06:16	LOW	2