netron

maintainer petronny · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command runs electron-builder locally to package a prebuilt application from the project's own source, which is a normal part of the build process and not an execution of a remote untrusted package.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx command runs electron-builder locally to package a prebuilt application from the project's own source, which is a normal part of the build process and not an execution of a remote untrusted package.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:40 npx electron-builder --linux dir --publish never

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jingbei Li <i@jingbei.li>
    
      2# Contributor: Chih-Hsuan Yen <yan12125@archlinux.org>
    
      3# Contributor: Filipe Bertelli <filipebertelli@tutanota.com>
    
      4# Contributor: J. C. Hammons <jch at bitma dot st>
    
      5# Contributor: Amr Okasha <amradel55 at gmail dot com>
    
      6# Contributor: Dimitris Kiziridis <ragouel at outlook dot com>
    
      7
    
      8pkgbase=netron
    
      9pkgname=(netron)
    
      10##pkgname+=(netron-cli)
    
      11pkgdesc='Visualizer for neural network, deep learning, and machine learning models'
    
      12pkgver=9.2.0
    
      13pkgrel=1
    
      14url='https://netron.app/'
    
      15arch=(x86_64)
    
      16license=(MIT)
    
      17depends=(python)
    
      18makedepends=(gendesk npm python-setuptools python-build python-installer python-wheel libxcrypt-compat)
    
      19optdepends=(
    
      20  'python-onnx: serializing ONNX models'
    
      21  'python-pytorch: serializing PyTorch models'
    
      22)
    
      23source=("https://github.com/lutzroeder/netron/archive/v${pkgver}/netron-${pkgver}.tar.gz")
    
      24sha256sums=('f6f2c65b76748edc68addd85d1f33663e45d30eab53b1e95a2436203ff974ee8')
    
      25
    
      26prepare() {
    
      27  cd "${pkgbase}-${pkgver}"
    
      28
    
      29  # Use dependencies from Arch
    
      30  sed '/python -m pip/d' -i package.js
    
      31
    
      32  # Disable mac and windows builds
    
      33  sed -e '/--mac /d' -e '/--win /d' -i package.js
    
      34}
    
      35
    
      36build() {
    
      37  cd "${pkgbase}-${pkgver}"
    
      38  npm run clean
    
      39  npm run build python
    
      40  npx electron-builder --linux dir --publish never
    
      41}
    
      42
    
      43package_netron() {
    
      44  depends+=('gtk3' 'nss' 'dbus-glib' 'libdbusmenu-glib')
    
      45  provides=('netron' 'netron-cli')
    
      46  conflicts=('netron-cli' 'netron-bin')
    
      47
    
      48  cd "${pkgbase}-${pkgver}"
    
      49  python -m installer --destdir="$pkgdir" dist/pypi/*.whl
    
      50  #mv "${pkgdir}/usr/bin/${pkgbase}" "${pkgdir}/usr/bin/${pkgbase}-cli"
    
      51
    
      52  mkdir -p "${pkgdir}/opt/"
    
      53  cp -r dist/linux-unpacked "${pkgdir}/opt/${pkgname}"
    
      54  #ln -s "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      55
    
      56  install -Dm644 publish/icon.png "${pkgdir}/usr/share/pixmaps/${pkgbase}.png"
    
      57  gendesk -f -n --pkgname "${pkgname}" \
    
      58          --pkgdesc "${pkgdesc}" \
    
      59          --name "Netron" \
    
      60          --comment "${pkgdesc}" \
    
      61          --exec "/opt/${pkgname}/${pkgname}" \
    
      62          --categories 'Development;Application;' \
    
      63          --icon "${pkgname}"
    
      64  install -Dm644 "${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      65
    
      66  install -Dm644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
    
      67}
    
      68
    
      69package_netron-cli() {
    
      70  pkgdesc="${pkgdesc} (CLI only)"
    
      71  arch=(any)
    
      72  conflicts=('netron')
    
      73
    
      74  cd "${pkgbase}-${pkgver}"
    
      75  python -m installer --destdir="$pkgdir" dist/pypi/*.whl
    
      76  #mv "${pkgdir}/usr/bin/${pkgbase}" "${pkgdir}/usr/bin/${pkgbase}-cli"
    
      77
    
      78  install -Dm644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
    
      79}
    
      80

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -9,7 +9,7 @@
 pkgname=(netron)
 ##pkgname+=(netron-cli)
 pkgdesc='Visualizer for neural network, deep learning, and machine learning models'
-pkgver=9.1.9
+pkgver=9.2.0
 pkgrel=1
 url='https://netron.app/'
 arch=(x86_64)
@@ -21,7 +21,7 @@
   'python-pytorch: serializing PyTorch models'
 )
 source=("https://github.com/lutzroeder/netron/archive/v${pkgver}/netron-${pkgver}.tar.gz")
-sha256sums=('e9e217aff073fb55f6e628e439e6ba2fd4f4b1be4c806cc3efd4add947d71922')
+sha256sums=('f6f2c65b76748edc68addd85d1f33663e45d30eab53b1e95a2436203ff974ee8')
 
 prepare() {
   cd "${pkgbase}-${pkgver}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 11:20:22	MEDIUM	1
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 09:29:42	MEDIUM	1
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 11:10:52	MEDIUM	1
2026-07-19 00:17:08	LOW	2
2026-07-18 09:57:20	MEDIUM	1