netron

LOW

maintainer petronny 2 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The npx command runs electron-builder locally on the project's own built code, not on a remote package, so it does not execute untrusted remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs electron-builder locally on the project's own built code, not on a remote package, so it does not execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:40 npx electron-builder --linux dir --publish never

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jingbei Li <i@jingbei.li>
    
      2# Contributor: Chih-Hsuan Yen <yan12125@archlinux.org>
    
      3# Contributor: Filipe Bertelli <filipebertelli@tutanota.com>
    
      4# Contributor: J. C. Hammons <jch at bitma dot st>
    
      5# Contributor: Amr Okasha <amradel55 at gmail dot com>
    
      6# Contributor: Dimitris Kiziridis <ragouel at outlook dot com>
    
      7
    
      8pkgbase=netron
    
      9pkgname=(netron)
    
      10##pkgname+=(netron-cli)
    
      11pkgdesc='Visualizer for neural network, deep learning, and machine learning models'
    
      12pkgver=9.3.4
    
      13pkgrel=1
    
      14url='https://netron.app/'
    
      15arch=(x86_64)
    
      16license=(MIT)
    
      17depends=(python)
    
      18makedepends=(gendesk npm python-setuptools python-build python-installer python-wheel libxcrypt-compat)
    
      19optdepends=(
    
      20  'python-onnx: serializing ONNX models'
    
      21  'python-pytorch: serializing PyTorch models'
    
      22)
    
      23source=("https://github.com/lutzroeder/netron/archive/v${pkgver}/netron-${pkgver}.tar.gz")
    
      24sha256sums=('8767e71cffc13babe34cc21cf80ed1c599aecb5428bb9915240d272dfefac810')
    
      25
    
      26prepare() {
    
      27  cd "${pkgbase}-${pkgver}"
    
      28
    
      29  # Use dependencies from Arch
    
      30  sed '/python -m pip/d' -i package.js
    
      31
    
      32  # Disable mac and windows builds
    
      33  sed -e '/--mac /d' -e '/--win /d' -i package.js
    
      34}
    
      35
    
      36build() {
    
      37  cd "${pkgbase}-${pkgver}"
    
      38  npm run clean
    
      39  npm run build python
    
      40  npx electron-builder --linux dir --publish never
    
      41}
    
      42
    
      43package_netron() {
    
      44  depends+=('gtk3' 'nss' 'dbus-glib' 'libdbusmenu-glib')
    
      45  provides=('netron' 'netron-cli')
    
      46  conflicts=('netron-cli' 'netron-bin')
    
      47
    
      48  cd "${pkgbase}-${pkgver}"
    
      49  python -m installer --destdir="$pkgdir" dist/pypi/*.whl
    
      50  #mv "${pkgdir}/usr/bin/${pkgbase}" "${pkgdir}/usr/bin/${pkgbase}-cli"
    
      51
    
      52  mkdir -p "${pkgdir}/opt/"
    
      53  cp -r dist/linux-unpacked "${pkgdir}/opt/${pkgname}"
    
      54  #ln -s "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      55
    
      56  install -Dm644 publish/icon.png "${pkgdir}/usr/share/pixmaps/${pkgbase}.png"
    
      57  gendesk -f -n --pkgname "${pkgname}" \
    
      58          --pkgdesc "${pkgdesc}" \
    
      59          --name "Netron" \
    
      60          --comment "${pkgdesc}" \
    
      61          --exec "/opt/${pkgname}/${pkgname}" \
    
      62          --categories 'Development;Application;' \
    
      63          --icon "${pkgname}"
    
      64  install -Dm644 "${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      65
    
      66  install -Dm644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
    
      67}
    
      68
    
      69package_netron-cli() {
    
      70  pkgdesc="${pkgdesc} (CLI only)"
    
      71  arch=(any)
    
      72  conflicts=('netron')
    
      73
    
      74  cd "${pkgbase}-${pkgver}"
    
      75  python -m installer --destdir="$pkgdir" dist/pypi/*.whl
    
      76  #mv "${pkgdir}/usr/bin/${pkgbase}" "${pkgdir}/usr/bin/${pkgbase}-cli"
    
      77
    
      78  install -Dm644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
    
      79}
    
      80

Changes since previous scan

--- PKGBUILD @ 2026-10-31 00:07
+++ PKGBUILD @ 2026-11-01 00:21
@@ -9,7 +9,7 @@
 pkgname=(netron)
 ##pkgname+=(netron-cli)
 pkgdesc='Visualizer for neural network, deep learning, and machine learning models'
-pkgver=9.3.3
+pkgver=9.3.4
 pkgrel=1
 url='https://netron.app/'
 arch=(x86_64)
@@ -21,7 +21,7 @@
   'python-pytorch: serializing PyTorch models'
 )
 source=("https://github.com/lutzroeder/netron/archive/v${pkgver}/netron-${pkgver}.tar.gz")
-sha256sums=('928e06af773bb6513d06ea49fe9217fa008383d670b727a92d17cdb2bf09926a')
+sha256sums=('8767e71cffc13babe34cc21cf80ed1c599aecb5428bb9915240d272dfefac810')
 
 prepare() {
   cd "${pkgbase}-${pkgver}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 15:58:34	Medium	1
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 13:40:12	Medium	1
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 13:18:05	Medium	1
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2