mustang

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The PKGBUILD installs Node.js packages via yarn using variables and modifies package.json at build time, introducing a supply-chain risk if the source or registry is compromised, though it uses npm/yarn registries and project-owned sources.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:141 yarn add -D semver
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD installs Node.js packages via yarn using variables and modifies package.json at build time, introducing a supply-chain risk if the source or registry is compromised, though it uses npm/yarn registries and project-owned sources.

  • PKGBUILD:90 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=mustang
3_pkgname=Mustang
4pkgver=0.9.41
5_electronversion=41
6_nodeversion=24
7pkgrel=1
8pkgdesc="New full-featured desktop email, chat and video conference client."
9arch=('any')
10url="https://parula.app/"
11_ghurl="https://github.com/mustang-im/mustang"
12license=('EUPL-1.2')
13depends=(
14 "electron${_electronversion}"
15)
16makedepends=(
17 'npm'
18 'nvm'
19 'gendesk'
20 'git'
21 'yarn'
22 'jq'
23)
24source=(
25 "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
26 "${pkgname}.js"
27 "${pkgname}.sh"
28)
29sha256sums=('2c926655eadb9583e8e4a2e3ccbf3c794fcdfe099ea420248b050d92e62e04a0'
30 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
31 '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
32_get_project_dir() {
33 local d
34 while IFS= read -r d; do
35 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
36 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
37}
38_ensure_local_nvm() {
39 local NVM_DIR="${srcdir}/.nvm"
40 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
41 nvm install "${_nodeversion}"
42 nvm use "${_nodeversion}"
43}
44_get_app_dir() {
45 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
46 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
47}
48_get_electron_version() {
49 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
50 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
51 | grep -oE '[0-9]+' | head -1)
52 [[ -z "${_elec_ver}" ]] && return 1
53 (( _elec_ver == _electronversion )) && c=32 || c=31
54 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
55}
56_set_build_env() {
57 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
58 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
59 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
60 export ELECTRON_BUILDER_OFFLINE=true
61 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
62 export HOME="${srcdir}/.home"
63 export XDG_CACHE_HOME="${HOME}/.cache"
64 export XDG_CONFIG_HOME="${HOME}/.config"
65 export XDG_DATA_HOME="${HOME}/.local/share"
66 export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
67 export YARN_NETWORK_CONCURRENCY=32
68 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
69 export COREPACK_HOME="${HOME}/.corepack"
70 export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
71 local _yarnver _yarnmajor=0
72 _yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"
73 _yarnmajor="${_yarnver%%.*}"
74 _yarnmajor="${_yarnmajor:-0}"
75 if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
76 export XDG_STATE_HOME="${HOME}/.local/state"
77 export YARN_ENABLE_GLOBAL_CACHE=false
78 export YARN_ENABLE_MIRROR=false
79 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
80 export YARN_NODE_LINKER=node-modules
81 export YARN_NM_MODE=hardlinks-local
82 export YARN_ENABLE_TELEMETRY=false
83 export YARN_ENABLE_SCRIPTS=true
84 export YARN_HTTP_TIMEOUT=600000
85 export YARN_HTTP_RETRY=5
86 export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
87 local _yarnhome="${HOME}/.yarn/install"
88 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
89 if [[ -n "${_yarnver}" ]]; then
90 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
91 export PATH="${_yarnhome}/bin:${PATH}"
92 fi
93 else
94 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
95 export YARN_LINK_FOLDER="${HOME}/.yarn/link"
96 export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
97 export YARN_NETWORK_TIMEOUT=600000
98 export YARN_CHILD_CONCURRENCY="$(nproc)"
99 export YARN_FROZEN_LOCKFILE=true
100 export YARN_IGNORE_ENGINES=true
101 export YARN_PRODUCTION=false
102 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
103 fi
104 local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
105 export YARN_REGISTRY="${_reg}"
106 _reg="${_reg%/}"
107 if [[ -f .yarnrc ]]; then
108 sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
109 fi
110 if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
111 sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
112 fi
113}
114prepare() {
115 cd "$(_get_project_dir)"
116 _get_electron_version
117 sed -i -e "
118 s/@electronversion@/${_electronversion}/g
119 s/@appname@/${pkgname}/g
120 " "${srcdir}/${pkgname}.sh" "${srcdir}/${pkgname}.js"
121 gendesk -q -f -n \
122 --pkgname="${pkgname}" \
123 --pkgdesc="${pkgdesc}" \
124 --categories="Network" \
125 --name="${_pkgname}" \
126 --exec="${pkgname} %U"
127 _ensure_local_nvm
128 _set_build_env
129 export NODE_ENV=development
130 cd "$(_get_project_dir)/app/build"
131 sh "${pkgname}-brand.sh"
132 cd "$(_get_project_dir)/app"
133 yarn install
134 cd "$(_get_project_dir)/lib"
135 yarn install
136 cd "$(_get_project_dir)/desktop"
137 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
138 yarn install
139 cd "$(_get_project_dir)/desktop/backend"
140 yarn install
141 yarn add -D semver
142}
143build() {
144 cd "$(_get_project_dir)/desktop"
145 _ensure_local_nvm
146 _set_build_env
147 export NODE_OPTIONS="--max-old-space-size=4096"
148 export NODE_ENV=production
149 yarn run build
150 yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
151 local _archrem=$([[ "${CARCH}" == "aarch64" ]] && echo x64 || echo arm)
152 find "$(_get_app_dir)" -type d \
153 \( -name 'darwin*' -o -name '*android*' -o -name 'win32*' -o -name "*${_archrem}*" \) \
154 -prune -exec rm -rf {} +
155 rm -rf "$(_get_app_dir)/resources/default_app.asar"
156}
157package() {
158 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
159 install -Dm644 "${srcdir}/${pkgname}.js" -t "${pkgdir}/usr/lib/${pkgname}"
160 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
161 install -Dm644 "$(_get_project_dir)/desktop/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
162 install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
163 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
164}
165

Changes since previous scan

--- PKGBUILD @ 2026-10-27 00:23
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=mustang
_pkgname=Mustang
-pkgver=0.9.40
+pkgver=0.9.41
_electronversion=41
_nodeversion=24
pkgrel=1
@@ -23,10 +23,12 @@
)
source=(
"${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
- "${pkgname}.sh"
+ "${pkgname}.js"
+ "${pkgname}.sh"
)
-sha256sums=('cedb1215613e43a0f65be959de62729e390d09437b70e309edbb5874d7b7be57'
- 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
+sha256sums=('2c926655eadb9583e8e4a2e3ccbf3c794fcdfe099ea420248b050d92e62e04a0'
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
_get_project_dir() {
local d
while IFS= read -r d; do
@@ -115,7 +117,7 @@
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname}/g
- " "${srcdir}/${pkgname}.sh"
+ " "${srcdir}/${pkgname}.sh" "${srcdir}/${pkgname}.js"
gendesk -q -f -n \
--pkgname="${pkgname}" \
--pkgdesc="${pkgdesc}" \
@@ -154,7 +156,7 @@
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
- install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
+ install -Dm644 "${srcdir}/${pkgname}.js" -t "${pkgdir}/usr/lib/${pkgname}"
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
install -Dm644 "$(_get_project_dir)/desktop/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Medium 2
2026-10-31 00:07:41 Medium 2
2026-10-30 00:29:30 Medium 2
2026-10-29 00:13:55 Medium 2
2026-10-28 00:06:54 Medium 2
2026-10-27 03:46:34 Medium 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 09:25:06 Medium 1
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion