netron

LOW

maintainer petronny 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx command is used to run electron-builder on the locally built project, not to execute an arbitrary remote package; the source is the project's own GitHub repository and the build is standard for the project.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx command is used to run electron-builder on the locally built project, not to execute an arbitrary remote package; the source is the project's own GitHub repository and the build is standard for the project.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:40 npx electron-builder --linux dir --publish never

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jingbei Li <i@jingbei.li>
    
      2# Contributor: Chih-Hsuan Yen <yan12125@archlinux.org>
    
      3# Contributor: Filipe Bertelli <filipebertelli@tutanota.com>
    
      4# Contributor: J. C. Hammons <jch at bitma dot st>
    
      5# Contributor: Amr Okasha <amradel55 at gmail dot com>
    
      6# Contributor: Dimitris Kiziridis <ragouel at outlook dot com>
    
      7
    
      8pkgbase=netron
    
      9pkgname=(netron)
    
      10##pkgname+=(netron-cli)
    
      11pkgdesc='Visualizer for neural network, deep learning, and machine learning models'
    
      12pkgver=9.2.8
    
      13pkgrel=1
    
      14url='https://netron.app/'
    
      15arch=(x86_64)
    
      16license=(MIT)
    
      17depends=(python)
    
      18makedepends=(gendesk npm python-setuptools python-build python-installer python-wheel libxcrypt-compat)
    
      19optdepends=(
    
      20  'python-onnx: serializing ONNX models'
    
      21  'python-pytorch: serializing PyTorch models'
    
      22)
    
      23source=("https://github.com/lutzroeder/netron/archive/v${pkgver}/netron-${pkgver}.tar.gz")
    
      24sha256sums=('c155d5ceb79ca7f04e8592ceda2a321814bb455b6c5bf272137d9108abf0de17')
    
      25
    
      26prepare() {
    
      27  cd "${pkgbase}-${pkgver}"
    
      28
    
      29  # Use dependencies from Arch
    
      30  sed '/python -m pip/d' -i package.js
    
      31
    
      32  # Disable mac and windows builds
    
      33  sed -e '/--mac /d' -e '/--win /d' -i package.js
    
      34}
    
      35
    
      36build() {
    
      37  cd "${pkgbase}-${pkgver}"
    
      38  npm run clean
    
      39  npm run build python
    
      40  npx electron-builder --linux dir --publish never
    
      41}
    
      42
    
      43package_netron() {
    
      44  depends+=('gtk3' 'nss' 'dbus-glib' 'libdbusmenu-glib')
    
      45  provides=('netron' 'netron-cli')
    
      46  conflicts=('netron-cli' 'netron-bin')
    
      47
    
      48  cd "${pkgbase}-${pkgver}"
    
      49  python -m installer --destdir="$pkgdir" dist/pypi/*.whl
    
      50  #mv "${pkgdir}/usr/bin/${pkgbase}" "${pkgdir}/usr/bin/${pkgbase}-cli"
    
      51
    
      52  mkdir -p "${pkgdir}/opt/"
    
      53  cp -r dist/linux-unpacked "${pkgdir}/opt/${pkgname}"
    
      54  #ln -s "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      55
    
      56  install -Dm644 publish/icon.png "${pkgdir}/usr/share/pixmaps/${pkgbase}.png"
    
      57  gendesk -f -n --pkgname "${pkgname}" \
    
      58          --pkgdesc "${pkgdesc}" \
    
      59          --name "Netron" \
    
      60          --comment "${pkgdesc}" \
    
      61          --exec "/opt/${pkgname}/${pkgname}" \
    
      62          --categories 'Development;Application;' \
    
      63          --icon "${pkgname}"
    
      64  install -Dm644 "${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      65
    
      66  install -Dm644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
    
      67}
    
      68
    
      69package_netron-cli() {
    
      70  pkgdesc="${pkgdesc} (CLI only)"
    
      71  arch=(any)
    
      72  conflicts=('netron')
    
      73
    
      74  cd "${pkgbase}-${pkgver}"
    
      75  python -m installer --destdir="$pkgdir" dist/pypi/*.whl
    
      76  #mv "${pkgdir}/usr/bin/${pkgbase}" "${pkgdir}/usr/bin/${pkgbase}-cli"
    
      77
    
      78  install -Dm644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
    
      79}
    
      80

Changes since previous scan

--- PKGBUILD @ 2026-09-12 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -9,7 +9,7 @@
 pkgname=(netron)
 ##pkgname+=(netron-cli)
 pkgdesc='Visualizer for neural network, deep learning, and machine learning models'
-pkgver=9.2.6
+pkgver=9.2.8
 pkgrel=1
 url='https://netron.app/'
 arch=(x86_64)
@@ -21,7 +21,7 @@
   'python-pytorch: serializing PyTorch models'
 )
 source=("https://github.com/lutzroeder/netron/archive/v${pkgver}/netron-${pkgver}.tar.gz")
-sha256sums=('0afdf95400fc234b7138b35470c8c440843bf6dd9064f1f66ba73f7cfa67ac75')
+sha256sums=('c155d5ceb79ca7f04e8592ceda2a321814bb455b6c5bf272137d9108abf0de17')
 
 prepare() {
   cd "${pkgbase}-${pkgver}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 13:12:15	Medium	1
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 14:00:22	Medium	1
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 15:45:42	Medium	1