nuclear-player
LOW
maintainer zxp19821005
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pnpm install runs on the project's own source from GitHub and is part of normal build process; installing dev dependencies like node-addon-api is expected for building, not a supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pnpm install runs on the project's own source from GitHub and is part of normal build process; installing dev dependencies like node-addon-api is expected for building, not a supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:76
NODE_ENV=development pnpm add -D node-addon-api node-gyp
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
# Contributor: Mikel Pintado <mikelaitornube2010@gmail.com>
3
_appname=nuclear
4
pkgname="${_appname}-player"
5
_pkgname='Nuclear Player'
6
pkgver=1.47.1
7
_nodeversion=24
8
pkgrel=1
9
pkgdesc="Streaming music player that finds free music for you."
10
arch=('any')
11
url="https://nuclearplayer.com/"
12
_ghurl="https://github.com/nukeop/nuclear"
13
license=('AGPL-3.0-only')
14
depends=(
15
'webkit2gtk-4.1'
16
'libsoup3'
17
'gtk3'
18
'wavpack'
19
'gst-plugins-good'
20
)
21
makedepends=(
22
'pnpm'
23
'nvm'
24
'curl'
25
'rustup'
26
)
27
optdepends=(
28
'gst-plugins-bad: Additional media codec support'
29
'gst-plugins-ugly: Patented codec support'
30
'gst-libav: FFmpeg-based codec support'
31
)
32
source=("${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/player@${pkgver}.tar.gz")
33
sha256sums=('abcbadab8c46c3838e4d467332837c1b1114ff42d95f2549ed04622f109d6b8e')
34
_ensure_local_nvm() {
35
local NVM_DIR="${srcdir}/.nvm"
36
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
37
nvm install "${_nodeversion}"
38
nvm use "${_nodeversion}"
39
}
40
_set_build_env() {
41
export HOME="${srcdir}/.electron-gyp"
42
export CARGO_HOME="${srcdir}/.cargo"
43
{
44
export PNPM_LINK_WORKSPACE_PACKAGES=true
45
export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
46
export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
47
export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
48
export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
49
export PNPM_SHAMEFULLY_HOIST=true
50
export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
51
export PNPM_NODE_LINKER=hoisted
52
export PNPM_NETWORK_CONCURRENCY=32
53
}
54
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
55
{
56
export pnpm_config_registry="https://registry.npmmirror.com"
57
export npm_config_registry="https://registry.npmmirror.com"
58
export RUSTUP_DIST_SERVER=https://mirrors.ustc.edu.cn/rust-static
59
export RUSTUP_UPDATE_ROOT=https://mirrors.ustc.edu.cn/rust-static/rustup
60
}
61
fi
62
}
63
prepare() {
64
cd "${srcdir}/${pkgname}-${pkgver}"
65
_set_build_env
66
_ensure_local_nvm
67
sed -i -e "
68
s/Exec=nuclear-music-player/Exec=${pkgname}/g
69
s/Icon=com.nuclearplayer.Nuclear/Icon=${pkgname}/g
70
" packages/player/src-tauri/resources/com.nuclearplayer.Nuclear.desktop
71
sed -i "s/com.nuclearplayer.Nuclear/${pkgname}/g" packages/player/src-tauri/resources/com.nuclearplayer.Nuclear.metainfo.xml
72
sed -i -e "
73
s/\"active\"\: true\,/\"active\"\: false\,/g
74
s/${_appname}-music-player/${pkgname}/g
75
" packages/player/src-tauri/tauri.conf.json
76
NODE_ENV=development pnpm add -D node-addon-api node-gyp
77
NODE_ENV=development pnpm install --no-frozen-lockfile
78
rustup default stable
79
}
80
build() {
81
_set_build_env
82
_ensure_local_nvm
83
cd "${srcdir}/${pkgname}-${pkgver}/packages/model"
84
NODE_ENV=production pnpm run build
85
cd "${srcdir}/${pkgname}-${pkgver}/packages/website"
86
NODE_ENV=production pnpm run build
87
cd "${srcdir}/${pkgname}-${pkgver}/packages/i18n"
88
NODE_ENV=production pnpm run build
89
cd "${srcdir}/${pkgname}-${pkgver}/packages/themes"
90
NODE_ENV=production pnpm run build
91
cd "${srcdir}/${pkgname}-${pkgver}/packages/hifi"
92
NODE_ENV=production pnpm run build
93
cd "${srcdir}/${pkgname}-${pkgver}/packages/ui"
94
NODE_ENV=production pnpm run build
95
cd "${srcdir}/${pkgname}-${pkgver}/packages/plugin-sdk"
96
NODE_ENV=production pnpm run build
97
cd "${srcdir}/${pkgname}-${pkgver}/packages/storybook"
98
NODE_ENV=production pnpm run build
99
cd "${srcdir}/${pkgname}-${pkgver}/packages/player"
100
NODE_ENV=production pnpm run build
101
}
102
package() {
103
install -Dm755 "${srcdir}/${pkgname}-${pkgver}/packages/player/src-tauri/target/release/${pkgname}" -t "${pkgdir}/usr/bin"
104
install -Dm755 "${srcdir}/${pkgname}-${pkgver}/packages/player/src-tauri/resources/com.nuclearplayer.Nuclear.desktop" \
105
"${pkgdir}/usr/share/applications/${pkgname}.desktop"
106
install -Dm755 "${srcdir}/${pkgname}-${pkgver}/packages/player/src-tauri/resources/com.nuclearplayer.Nuclear.metainfo.xml" \
107
"${pkgdir}/usr/share/metainfo/${pkgname}.metainfo.xml"
108
install -Dm755 "${srcdir}/${pkgname}-${pkgver}/packages/player/src-tauri/icons/icon.png" \
109
"${pkgdir}/usr/share/pixmaps/${pkgname}.png"
110
}
111
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 03:13:17 | Medium | 1 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |