nuclear-player

maintainer zxp19821005 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged 'pnpm add' installs development dependencies node-addon-api and node-gyp required for building the project; these are standard build tools for Node.js native addons and are not malicious, undeclared external packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged 'pnpm add' installs development dependencies node-addon-api and node-gyp required for building the project; these are standard build tools for Node.js native addons and are not malicious, undeclared external packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:76 NODE_ENV=development pnpm add -D node-addon-api node-gyp

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Contributor: Mikel Pintado <mikelaitornube2010@gmail.com>
    
      3_appname=nuclear
    
      4pkgname="${_appname}-player"
    
      5_pkgname='Nuclear Player'
    
      6pkgver=1.43.2
    
      7_nodeversion=24
    
      8pkgrel=1
    
      9pkgdesc="Streaming music player that finds free music for you."
    
      10arch=('any')
    
      11url="https://nuclearplayer.com/"
    
      12_ghurl="https://github.com/nukeop/nuclear"
    
      13license=('AGPL-3.0-only')
    
      14depends=(
    
  'webkit2gtk-4.1'
    
  'libsoup3'
    
  'gtk3'
    
  'wavpack'
    
  'gst-plugins-good'
    
      20)
    
      21makedepends=(
    
  'pnpm'
    
  'nvm'
    
  'curl'
    
  'rustup'
    
      26)
    
      27optdepends=(
    
  'gst-plugins-bad: Additional media codec support'
    
  'gst-plugins-ugly: Patented codec support'
    
  'gst-libav: FFmpeg-based codec support'
    
      31)
    
      32source=("${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/player@${pkgver}.tar.gz")
    
      33sha256sums=('f3269c81a796560d41dc5da5f7a21b016bdf2d8d5818f0412ebf1b8412652374')
    
      34_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      39}
    
      40_set_build_env() {
    
  export HOME="${srcdir}/.electron-gyp"
    
  export CARGO_HOME="${srcdir}/.cargo"
    
  {
    
      export PNPM_LINK_WORKSPACE_PACKAGES=true
    
      export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
    
      export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
    
      export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
    
      export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
    
      export PNPM_SHAMEFULLY_HOIST=true
    
      export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
    
      export PNPM_NODE_LINKER=hoisted
    
      export PNPM_NETWORK_CONCURRENCY=32
    
  }
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      {
    
          export pnpm_config_registry="https://registry.npmmirror.com"
    
          export npm_config_registry="https://registry.npmmirror.com"
    
          export RUSTUP_DIST_SERVER=https://mirrors.ustc.edu.cn/rust-static
    
          export RUSTUP_UPDATE_ROOT=https://mirrors.ustc.edu.cn/rust-static/rustup
    
      }
    
  fi
    
      62}
    
      63prepare() {
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  _set_build_env
    
  _ensure_local_nvm
    
  sed -i -e "
    
      s/Exec=nuclear-music-player/Exec=${pkgname}/g
    
      s/Icon=com.nuclearplayer.Nuclear/Icon=${pkgname}/g
    
  " packages/player/src-tauri/resources/com.nuclearplayer.Nuclear.desktop
    
  sed -i "s/com.nuclearplayer.Nuclear/${pkgname}/g" packages/player/src-tauri/resources/com.nuclearplayer.Nuclear.metainfo.xml
    
  sed -i -e "
    
      s/\"active\"\: true\,/\"active\"\: false\,/g
    
      s/${_appname}-music-player/${pkgname}/g
    
  " packages/player/src-tauri/tauri.conf.json
    
  NODE_ENV=development    pnpm add -D node-addon-api node-gyp
    
  NODE_ENV=development    pnpm install --no-frozen-lockfile
    
  rustup default stable
    
      79}
    
      80build() {
    
  _set_build_env
    
  _ensure_local_nvm
    
  cd "${srcdir}/${pkgname}-${pkgver}/packages/model"
    
  NODE_ENV=production     pnpm run build
    
  cd "${srcdir}/${pkgname}-${pkgver}/packages/website"
    
  NODE_ENV=production     pnpm run build
    
  cd "${srcdir}/${pkgname}-${pkgver}/packages/i18n"
    
  NODE_ENV=production     pnpm run build
    
  cd "${srcdir}/${pkgname}-${pkgver}/packages/themes"
    
  NODE_ENV=production     pnpm run build
    
  cd "${srcdir}/${pkgname}-${pkgver}/packages/hifi"
    
  NODE_ENV=production     pnpm run build
    
  cd "${srcdir}/${pkgname}-${pkgver}/packages/ui"
    
  NODE_ENV=production     pnpm run build
    
  cd "${srcdir}/${pkgname}-${pkgver}/packages/plugin-sdk"
    
  NODE_ENV=production     pnpm run build
    
  cd "${srcdir}/${pkgname}-${pkgver}/packages/storybook"
    
  NODE_ENV=production     pnpm run build
    
  cd "${srcdir}/${pkgname}-${pkgver}/packages/player"
    
  NODE_ENV=production     pnpm run build
    
      101}
    
      102package() {
    
  install -Dm755 "${srcdir}/${pkgname}-${pkgver}/packages/player/src-tauri/target/release/${pkgname}" -t "${pkgdir}/usr/bin"
    
  install -Dm755 "${srcdir}/${pkgname}-${pkgver}/packages/player/src-tauri/resources/com.nuclearplayer.Nuclear.desktop" \
    
      "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
  install -Dm755 "${srcdir}/${pkgname}-${pkgver}/packages/player/src-tauri/resources/com.nuclearplayer.Nuclear.metainfo.xml" \
    
      "${pkgdir}/usr/share/metainfo/${pkgname}.metainfo.xml"
    
  install -Dm755 "${srcdir}/${pkgname}-${pkgver}/packages/player/src-tauri/icons/icon.png" \
    
      "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      110}
    
      111

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 _appname=nuclear
 pkgname="${_appname}-player"
 _pkgname='Nuclear Player'
-pkgver=1.43.0
+pkgver=1.43.2
 _nodeversion=24
 pkgrel=1
 pkgdesc="Streaming music player that finds free music for you."
@@ -30,7 +30,7 @@
     'gst-libav: FFmpeg-based codec support'
 )
 source=("${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/player@${pkgver}.tar.gz")
-sha256sums=('45405ecccf78af75cca5df3b20d05273521208e2b8ed571e85dab381d6f9074e')
+sha256sums=('f3269c81a796560d41dc5da5f7a21b016bdf2d8d5818f0412ebf1b8412652374')
 _ensure_local_nvm() {
     local NVM_DIR="${srcdir}/.nvm"
     source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 03:15:42	MEDIUM	1
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 03:53:53	MEDIUM	1
2026-07-17 00:06:16	LOW	2