nodeterm-bin

maintainer NickeyGod · 0 votes · scanned 2026-08-18 09:39:35.720982

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release, which is an unverifiable executable; if the source were swapped, it could lead to code execution, though the host (GitHub) is generally trusted.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release, which is an unverifiable executable; if the source were swapped, it could lead to code execution, though the host (GitHub) is generally trusted.

PKGBUILD

      1# Maintainer: NickeyGod <niklass.schaeffer@gmail.com>
    
      2
    
      3pkgname=nodeterm-bin
    
      4pkgver=0.3.2
    
      5pkgrel=1
    
      6pkgdesc="Node-based terminal manager — multiple draggable, zoomable terminals on a single canvas"
    
      7arch=('x86_64')
    
      8url="https://github.com/eneskirca/nodeterm"
    
      9license=('LicenseRef-BUSL-1.1')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'at-spi2-core'
    
      13  'gtk3'
    
      14  'libnotify'
    
      15  'libsecret'
    
      16  'libxss'
    
      17  'libxtst'
    
      18  'nss'
    
      19  'util-linux-libs'
    
      20  'xdg-utils'
    
      21)
    
      22optdepends=('libappindicator-gtk3: system tray support')
    
      23provides=('nodeterm')
    
      24conflicts=('nodeterm')
    
      25options=('!strip' '!emptydirs')
    
      26source=("node-terminal_${pkgver}_amd64.deb::https://github.com/eneskirca/nodeterm/releases/download/v${pkgver}/node-terminal_${pkgver}_amd64.deb")
    
      27sha256sums=('8d89400ef2af100401cc0ec4441aeafb3c362f98e3bff63910122a57f3857318')
    
      28
    
      29package() {
    
      30  bsdtar -xf data.tar.xz -C "$pkgdir"
    
      31
    
      32  # Fix chrome-sandbox SUID permissions
    
      33  chmod 4755 "$pkgdir/opt/nodeterm/chrome-sandbox"
    
      34
    
      35  # Symlink binary to PATH
    
      36  install -d "$pkgdir/usr/bin"
    
      37  ln -s /opt/nodeterm/node-terminal "$pkgdir/usr/bin/nodeterm"
    
      38
    
      39  # Rename desktop entry and icon to match package name
    
      40  mv "$pkgdir/usr/share/applications/node-terminal.desktop" \
    
      41     "$pkgdir/usr/share/applications/nodeterm.desktop"
    
      42  mv "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/node-terminal.png" \
    
      43     "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/nodeterm.png"
    
      44
    
      45  # Update desktop entry to use symlinked binary
    
      46  sed -i 's|Exec=/opt/nodeterm/node-terminal|Exec=nodeterm|' \
    
      47     "$pkgdir/usr/share/applications/nodeterm.desktop"
    
      48  sed -i 's|Icon=node-terminal|Icon=nodeterm|' \
    
      49     "$pkgdir/usr/share/applications/nodeterm.desktop"
    
      50}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 09:39:35	MEDIUM	2