nuclear-player

LOW
maintainer zxp19821005 1 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package builds from a verifiable GitHub source, uses standard build tools, and installs declared dependencies; the dynamic package manager and npm install calls are part of the project's normal build process and do not introduce untrusted external code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a verifiable GitHub source, uses standard build tools, and installs declared dependencies; the dynamic package manager and npm install calls are part of the project's normal build process and do not introduce untrusted external code.

  • PKGBUILD:90 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:110 pnpm add -D node-addon-api node-gyp

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2# Contributor: Mikel Pintado <mikelaitornube2010@gmail.com>
3_appname=nuclear
4pkgname="${_appname}-player"
5_pkgname='Nuclear Player'
6_debname="com.${pkgname//-/}.Nuclear"
7pkgver=1.52.2
8_nodeversion=24
9pkgrel=1
10pkgdesc="Streaming music player that finds free music for you."
11arch=('any')
12url="https://nuclearplayer.com/"
13_ghurl="https://github.com/nukeop/nuclear"
14license=('AGPL-3.0-only')
15depends=(
16 'webkit2gtk-4.1'
17 'libsoup3'
18 'gtk3'
19 'wavpack'
20 'gst-plugins-good'
21 'gst-plugins-base'
22)
23makedepends=(
24 'pnpm'
25 'nvm'
26 'rustup'
27 'jq'
28)
29optdepends=(
30 'gst-plugins-bad: Additional media codec support'
31 'gst-plugins-ugly: Patented codec support'
32 'gst-libav: FFmpeg-based codec support'
33)
34source=("${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/player@${pkgver}.tar.gz")
35sha256sums=('c33edf77b04a18e3470b6314c0a635cdd2e7addd5bd6395529587fbdd34d51bf')
36_ensure_local_nvm() {
37 local NVM_DIR="${srcdir}/.nvm"
38 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
39 nvm install "${_nodeversion}"
40 nvm use "${_nodeversion}"
41}
42_get_project_dir() {
43 local d
44 while IFS= read -r d; do
45 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
46 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
47}
48_get_app_dir() {
49 find "$(_get_project_dir)" -type d -name "release" -exec test -d "{}/.fingerprint" -a -d "{}/deps" \; -print -quit 2>/dev/null
50}
51_set_build_env() {
52 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
53 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
54 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
55 export ELECTRON_BUILDER_OFFLINE=true
56 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
57 export HOME="${srcdir}/.home"
58 export XDG_CACHE_HOME="${HOME}/.cache"
59 export XDG_CONFIG_HOME="${HOME}/.config"
60 export XDG_DATA_HOME="${HOME}/.local/share"
61 export XDG_STATE_HOME="${HOME}/.local/state"
62 export PNPM_HOME="${HOME}/.pnpm/bin"
63 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
64 export pnpm_config_store_dir="${HOME}/.pnpm_store"
65 export pnpm_config_global_dir="${HOME}/.pnpm/global"
66 export pnpm_config_state_dir="${HOME}/.pnpm/state"
67 export pnpm_config_node_linker=hoisted
68 export pnpm_config_minimum_release_age=0
69 export pnpm_config_update_notifier=false
70 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
71 export COREPACK_HOME="${HOME}/.corepack"
72 export CARGO_HOME="${HOME}/.cargo"
73 export CARGO_NET_GIT_FETCH_WITH_CLI=true
74 export CARGO_NET_RETRY=5
75 export CARGO_HTTP_MULTIPLEXING=false
76 export CARGO_INCREMENTAL=0
77 export CARGO_TERM_COLOR=never
78 export CARGO_PROFILE_RELEASE_STRIP=symbols
79 mkdir -p "${HOME}" "${CARGO_HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
80 export PATH="${PNPM_HOME}:${PATH}"
81 local _pnpmver=""
82 local _pkgjson="$(_get_project_dir)/package.json"
83 if [ -f "${_pkgjson}" ]; then
84 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
85 if [ -z "${_pnpmver}" ]; then
86 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
87 fi
88 fi
89 if [ -n "${_pnpmver}" ]; then
90 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
91 --registry "${COREPACK_NPM_REGISTRY}"
92 fi
93}
94prepare() {
95 cd "$(_get_project_dir)"
96 _ensure_local_nvm
97 _set_build_env
98 sed -i -e "
99 s/Exec=nuclear-music-player/Exec=${pkgname}/g
100 s/Icon=${_debname}/Icon=${pkgname}/g
101 " "packages/player/src-tauri/resources/${_debname}.desktop"
102 sed -i "s/${_debname}/${pkgname}/g" "packages/player/src-tauri/resources/${_debname}.metainfo.xml"
103 jq -r '
104 .bundle.active = false |
105 .mainBinaryName = "'"${pkgname}"'"
106 ' packages/player/src-tauri/tauri.conf.json > tmp.json && mv tmp.json packages/player/src-tauri/tauri.conf.json
107 rustup update stable
108 rustup default stable
109 export NODE_ENV=development
110 pnpm add -D node-addon-api node-gyp
111 pnpm install --no-frozen-lockfile
112}
113build() {
114 cd "$(_get_project_dir)"
115 _ensure_local_nvm
116 _set_build_env
117 export NODE_ENV=production
118 for pkg in model website i18n themes hifi ui plugin-sdk storybook player; do
119 msg2 "Building ${pkg}..."
120 cd "$(_get_project_dir)/packages/${pkg}"
121 echo y | pnpm run build || {
122 error "Failed to build ${pkg}"
123 return 1
124 }
125 done
126}
127package() {
128 install -Dm755 "$(_get_app_dir)/${pkgname}" -t "${pkgdir}/usr/bin"
129 install -Dm755 "$(_get_project_dir)/packages/player/src-tauri/resources/${_debname}.desktop" \
130 "${pkgdir}/usr/share/applications/${pkgname}.desktop"
131 install -Dm755 "$(_get_project_dir)/packages/player/src-tauri/resources/${_debname}.metainfo.xml" \
132 "${pkgdir}/usr/share/metainfo/${pkgname}.metainfo.xml"
133 _icon_sizes=(32x32 64x64 128x128 256x256 512x512)
134 for _icons in "${_icon_sizes[@]}";do
135 install -Dm644 "$(_get_project_dir)/flatpak/icons/${_icons}.png" \
136 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
137 done
138}
139

Changes since previous scan

--- PKGBUILD @ 2026-10-26 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -4,7 +4,7 @@
pkgname="${_appname}-player"
_pkgname='Nuclear Player'
_debname="com.${pkgname//-/}.Nuclear"
-pkgver=1.51.2
+pkgver=1.52.2
_nodeversion=24
pkgrel=1
pkgdesc="Streaming music player that finds free music for you."
@@ -32,7 +32,7 @@
'gst-libav: FFmpeg-based codec support'
)
source=("${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/player@${pkgver}.tar.gz")
-sha256sums=('96d63fff34fbe5b0b04e9af5af86548bee28eff985ee3a24d3c958d0bf20fc32')
+sha256sums=('c33edf77b04a18e3470b6314c0a635cdd2e7addd5bd6395529587fbdd34d51bf')
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
@@ -40,15 +40,13 @@
nvm use "${_nodeversion}"
}
_get_project_dir() {
- find "${srcdir}" -name "src-tauri" -type d ! -path "*/node_modules/*" 2>/dev/null | \
- while read -r tauri_dir; do
- [ -f "${tauri_dir}/Cargo.toml" ] || continue
- local dir="${tauri_dir}"
- until [ -f "${dir}/package.json" ] || [ "$dir" = "${srcdir}" ] || [ "$dir" = "/" ]; do
- dir="$(dirname "$dir")"
- done
- [ -f "${dir}/package.json" ] && { echo "$dir"; return; }
- done
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
+_get_app_dir() {
+ find "$(_get_project_dir)" -type d -name "release" -exec test -d "{}/.fingerprint" -a -d "{}/deps" \; -print -quit 2>/dev/null
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
@@ -127,11 +125,10 @@
done
}
package() {
- local _appdir="$(_get_project_dir)/packages/player/src-tauri"
- install -Dm755 "${_appdir}/target/release/${pkgname}" -t "${pkgdir}/usr/bin"
- install -Dm755 "${_appdir}/resources/${_debname}.desktop" \
+ install -Dm755 "$(_get_app_dir)/${pkgname}" -t "${pkgdir}/usr/bin"
+ install -Dm755 "$(_get_project_dir)/packages/player/src-tauri/resources/${_debname}.desktop" \
"${pkgdir}/usr/share/applications/${pkgname}.desktop"
- install -Dm755 "${_appdir}/resources/${_debname}.metainfo.xml" \
+ install -Dm755 "$(_get_project_dir)/packages/player/src-tauri/resources/${_debname}.metainfo.xml" \
"${pkgdir}/usr/share/metainfo/${pkgname}.metainfo.xml"
_icon_sizes=(32x32 64x64 128x128 256x256 512x512)
for _icons in "${_icon_sizes[@]}";do

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 21:45:59 Medium 1
2026-10-26 00:12:40 Medium 2
2026-10-25 00:20:48 Medium 2
2026-10-24 00:14:55 Medium 2
2026-10-23 00:02:19 Medium 2
2026-10-22 00:13:10 Medium 2
2026-10-21 00:12:50 Medium 2
2026-10-20 05:27:35 Medium 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion