newitemmonitor

maintainer AsukaMinato · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

piracy

Why flagged This PKGBUILD explicitly patches a proprietary application to bypass its VIP/license checks: it appends code to scsdef.js to set vip_source_limit to Infinity, and patches libscs.js to make isVIP() always return true and getVipLeftDays() return 999. This is software cracking/license circumvention, which qualifies as piracy regardless of whether it also contains malware. Additionally, it runs 'npm i sqlite3@5.0.2' without any integrity verification during the build, introducing an unverified supply-chain dependency. The source is a locally-provided Windows executable (local:// scheme) from a proprietary application. The piracy flag is the primary concern here — cracked proprietary software does not belong in the AUR per its rules.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:24 npm i sqlite3@5.0.2

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 92%): This PKGBUILD explicitly patches a proprietary application to bypass its VIP/license checks: it appends code to scsdef.js to set vip_source_limit to Infinity, and patches libscs.js to make isVIP() always return true and getVipLeftDays() return 999. This is software cracking/license circumvention, which qualifies as piracy regardless of whether it also contains malware. Additionally, it runs 'npm i sqlite3@5.0.2' without any integrity verification during the build, introducing an unverified supply-chain dependency. The source is a locally-provided Windows executable (local:// scheme) from a proprietary application. The piracy flag is the primary concern here — cracked proprietary software does not belong in the AUR per its rules.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Asuka Minato <i at asukaminato dot eu dot org>
    
      2pkgname=newitemmonitor
    
      3pkgver=1.0.3
    
      4pkgrel=2
    
      5pkgdesc="通用型上新监控器，上新时获得通知"
    
      6arch=(x86_64 aarch64)
    
      7url="https://fatecore.com/p/nim/"
    
      8license=('private')
    
      9depends=(electron4-bin bash glibc gcc-libs)
    
      10makedepends=(asar npm)
    
      11source=("local://nim-v${pkgver}-win.zip" # download from http://resource.fatecore.com/nim/download.html
    
      12	$pkgname.desktop
    
      13)
    
      14sha256sums=('37aa6933e5583833448f9e9410f54d39b27b55de0e5ef4969b6047eb692c5128'
    
      15            '11045c5d88008a723ec411feb12abb267bb9c39687797a0697aed0db8f8905c3')
    
      16options=(!emptydirs)
    
      17prepare() {
    
      18	bsdtar -xvpf *.exe resources
    
      19	pushd resources
    
      20	asar e app.asar ./app
    
      21	pushd app
    
      22	printf ';exports.vip_source_limit = Infinity;' >>./scsdef.js
    
      23	printf ';exports.isVIP = () => true;exports.getVipLeftDays = () => 999;' >>./sk_electron_common/scs/libscs.js
    
      24	npm i sqlite3@5.0.2
    
      25	rm -rf node_modules/{node-gyp,@types}
    
      26	find . -type f -path "*/node_modules/*/bin/*" -print -delete
    
      27	find . -type l -path "*/.bin/*" -delete
    
      28	find . -type f \( -name "*.d.ts" \
    
      29		-or -name "*.py" \
    
      30		-or -name "Dockerfile" \
    
      31		-or -name "cli.js" \
    
      32		-or -name "bin.js" \
    
      33		-or -name "build.js" \) -print -delete
    
      34	find . -type f -path "*/man/man1/*" -print -delete
    
      35}
    
      36
    
      37package() {
    
      38	install -vd $pkgdir/opt/$pkgname/
    
      39	cp -av resources/app $pkgdir/opt/$pkgname/
    
      40	printf "#!/bin/bash
    
      41exec electron4 /opt/$pkgname/app \"\$@\"
    
      42" | install -vDm755 /dev/stdin $pkgdir/usr/bin/$pkgname
    
      43	find $pkgdir -name "icon.png" -type f -print -exec install -Dm644 {} $pkgdir/usr/share/pixmaps/$pkgname.png \;
    
      44	install -vDm644 $pkgname.desktop -t $pkgdir/usr/share/applications/
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 00:17:23	HIGH	2
2026-07-29 00:25:53	HIGH	2
2026-07-28 00:07:28	HIGH	2
2026-07-27 00:24:32	HIGH	2
2026-07-26 00:07:32	HIGH	2
2026-07-25 00:13:44	HIGH	2
2026-07-24 00:02:28	HIGH	2
2026-07-23 00:14:47	HIGH	2
2026-07-22 00:29:32	HIGH	2
2026-07-21 00:24:15	HIGH	2
2026-07-20 00:19:49	HIGH	2
2026-07-19 00:17:08	HIGH	2
2026-07-18 00:14:48	HIGH	2
2026-07-17 00:06:16	HIGH	2
2026-07-16 00:05:41	HIGH	2
2026-07-15 00:09:25	HIGH	2