mxiv-git
maintainer zxp19821005
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The PKGBUILD builds an Electron app from a git source using npm install, which is a standard and common pattern in AUR packages for Electron/Node.js applications. The npm install pulls dependencies declared in the project's own package.json from the official npm registry (or npmmirror.com for CN users). The CN mirror switch (registry.npmmirror.com) is a well-known legitimate Chinese npm mirror, not a malicious host. The package-lock.json is present in the source repo, which pins dependency versions and hashes, significantly mitigating supply-chain risk. The `npm add -D @electron-forge/plugin-local-electron` installs a legitimate electron-forge plugin from the official registry. There is no execution of pre-built binaries from unofficial hosts, no obfuscation, and no exfiltration. The main concern (npm install pulling undeclared deps) is a standard AUR pattern for Node.js apps and is mitigated by the lockfile. This is sloppy/non-standard compared to offline builds but not a genuine security risk beyond the inherent npm ecosystem trust model.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The PKGBUILD builds an Electron app from a git source using npm install, which is a standard and common pattern in AUR packages for Electron/Node.js applications. The npm install pulls dependencies declared in the project's own package.json from the official npm registry (or npmmirror.com for CN users). The CN mirror switch (registry.npmmirror.com) is a well-known legitimate Chinese npm mirror, not a malicious host. The package-lock.json is present in the source repo, which pins dependency versions and hashes, significantly mitigating supply-chain risk. The `npm add -D @electron-forge/plugin-local-electron` installs a legitimate electron-forge plugin from the official registry. There is no execution of pre-built binaries from unofficial hosts, no obfuscation, and no exfiltration. The main concern (npm install pulling undeclared deps) is a standard AUR pattern for Node.js apps and is mitigated by the lockfile. This is sloppy/non-standard compared to offline builds but not a genuine security risk beyond the inherent npm ecosystem trust model.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:87
NODE_ENV=development npm add -D @electron-forge/plugin-local-electron
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=mxiv-git
3
pkgver=0.6.2.r1.g6af5af2
4
_electronversion=38
5
_nodeversion=22
6
pkgrel=1
7
pkgdesc="Media explorer and interactive viewer.(Use system-wide electron)"
8
arch=('any')
9
url="https://github.com/rvcalisto/mxiv"
10
license=('MIT')
11
conflicts=("${pkgname%-git}")
12
provides=("${pkgname%-git}")
13
depends=(
14
"electron${_electronversion}"
15
)
16
makedepends=(
17
'gendesk'
18
'git'
19
'nvm'
20
'npm'
21
'curl'
22
'jq'
23
)
24
options=(
25
'!strip'
26
'!emptydirs'
27
)
28
source=(
29
"${pkgname//-/.}::git+${url}.git"
30
"${pkgname%-git}.sh"
31
)
32
sha256sums=('SKIP'
33
'31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
34
pkgver() {
35
cd "${srcdir}/${pkgname//-/.}"
36
set -o pipefail
37
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
38
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
39
}
40
_ensure_local_nvm() {
41
local NVM_DIR="${srcdir}/.nvm"
42
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
43
nvm install "${_nodeversion}"
44
nvm use "${_nodeversion}"
45
}
46
_get_electron_version() {
47
_elec_ver=$(jq -r '.devDependencies["electron"] // .dependencies["electron"]' "${srcdir}/${pkgname//-/.}/package.json" | tr -d '^')
48
_main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
49
echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
50
}
51
prepare() {
52
cd "${srcdir}/${pkgname//-/.}"
53
_get_electron_version
54
sed -i -e "
55
s/@electronversion@/${_electronversion}/g
56
s/@appname@/${pkgname%-git}/g
57
s/@runname@/app.asar/g
58
s/@cfgdirname@/${pkgname%-git}/g
59
s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
60
" -i "${srcdir}/${pkgname%-git}.sh"
61
gendesk -q -f -n \
62
--pkgname="${pkgname%-git}" \
63
--pkgdesc="${pkgdesc}" \
64
--categories="AudioVideo" \
65
--name="${pkgname%-git}" \
66
--exec="${pkgname%-git} %U"
67
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
68
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
69
HOME="${srcdir}/.electron-gyp"
70
{
71
echo -e '\n'
72
#echo 'build_from_source=true'
73
echo "cache=${srcdir}/.npm_cache"
74
echo "maxsockets=32"
75
} >> .npmrc
76
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
77
{
78
export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
79
export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
80
export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
81
}
82
find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
83
fi
84
_ensure_local_nvm
85
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
86
NODE_ENV=development npm install
87
NODE_ENV=development npm add -D @electron-forge/plugin-local-electron
88
}
89
build() {
90
cd "${srcdir}/${pkgname//-/.}"
91
_ensure_local_nvm
92
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
93
local electronDist="/usr/lib/electron${_electronversion}"
94
sed -i '/makers: \[/i\
95
plugins: [\
96
{\
97
name: "@electron-forge/plugin-local-electron",\
98
config: {\
99
electronPath: "'"${electronDist}"'",\
100
},\
101
},\
102
],' forge.config.*
103
NODE_ENV=production npm run package
104
}
105
package() {
106
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
107
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
108
find "${srcdir}/${pkgname//-/.}/out/${pkgname%-git}-linux-"*"/resources" -maxdepth 1 -type f -exec install -Dm644 -t "${pkgdir}/usr/lib/${pkgname%-git}" {} +
109
if find "${srcdir}/${pkgname//-/.}/out/${pkgname%-git}-linux-"*"/resources" -mindepth 1 -maxdepth 1 -type d | read; then
110
for _subdir in "${srcdir}/${pkgname//-/.}/out/${pkgname%-git}-linux-"*"/resources/"*; do
111
if [ -d "${_subdir}" ]; then
112
cp -Pr --no-preserve=ownership "${_subdir}" "${pkgdir}/usr/lib/${pkgname%-git}"
113
fi
114
done
115
fi
116
install -Dm644 "${srcdir}/${pkgname//-/.}/src/icons/${pkgname%-git}.png" -t "${pkgdir}/usr/share/pixmaps"
117
install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
118
install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
119
}
120
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |