nvm-desktop-git

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source using project-owned repositories and installs only the resulting binaries; the use of cargo install for toml-cli is a build-time helper, not an external payload, and mirrors are used for availability, not untrusted code injection.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using project-owned repositories and installs only the resulting binaries; the use of cargo install for toml-cli is a build-time helper, not an external payload, and mirrors are used for availability, not untrusted code injection.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:83 cargo install toml-cli

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=nvm-desktop-git
    
      3_pkgname='NVM Desktop'
    
      4pkgver=4.4.0.r0.g0eeff7a
    
      5_nodeversion=24
    
      6pkgrel=1
    
      7pkgdesc="A version management desktop client for the Nodejs."
    
      8arch=('any')
    
      9url="https://github.com/1111mp/nvm-desktop"
    
      10_nvmdurl="https://github.com/1111mp/nvmd-command"
    
      11license=('MIT')
    
      12conflicts=("${pkgname%-git}")
    
      13provides=("${pkgname%-git}=${pkgver%.r*}")
    
      14depends=(
    
      15    'webkit2gtk-4.1'
    
      16    'gtk3'
    
      17)
    
      18makedepends=(
    
      19    'gendesk'
    
      20    'npm'
    
      21    'nvm'
    
      22    'pnpm'
    
      23    'curl'
    
      24    'git'
    
      25    'rust'
    
      26    'librsvg'
    
      27    'patchelf'
    
      28)
    
      29source=(
    
      30    "${pkgname%-git}.git::git+${url}"
    
      31    "nvmd.git::git+${_nvmdurl}"
    
      32)
    
      33sha256sums=('SKIP'
    
      34            'SKIP')
    
      35pkgver() {
    
      36    cd "${srcdir}/${pkgname%-git}.git"
    
      37    set -o pipefail
    
      38    git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
      39    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      40}
    
      41_set_build_env() {
    
      42    export HOME="${srcdir}/.electron-gyp"
    
      43    export CARGO_HOME="${srcdir}/.cargo"
    
      44    {
    
      45        export PNPM_LINK_WORKSPACE_PACKAGES=true
    
      46        export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
    
      47        export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
    
      48        export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
    
      49        export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
    
      50        export PNPM_SHAMEFULLY_HOIST=true
    
      51        export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
    
      52        export PNPM_NODE_LINKER=hoisted
    
      53        export PNPM_NETWORK_CONCURRENCY=32
    
      54    }
    
      55    if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      56        {
    
      57            export pnpm_config_registry="https://registry.npmmirror.com"
    
      58            export npm_config_registry="https://registry.npmmirror.com"
    
      59            export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
    
      60            export RUSTUP_DIST_SERVER="https://mirrors.aliyun.com/rustup"
    
      61            export RUSTUP_UPDATE_ROOT="https://mirrors.aliyun.com/rustup/rustup"
    
      62        }
    
      63    fi
    
      64}
    
      65_ensure_local_nvm() {
    
      66    local NVM_DIR="${srcdir}/.nvm"
    
      67    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      68    nvm install "${_nodeversion}"
    
      69    nvm use "${_nodeversion}"
    
      70}
    
      71prepare() {
    
      72    gendesk -f -n -q \
    
      73        --pkgname="${pkgname%-git}" \
    
      74        --pkgdesc="${pkgdesc}" \
    
      75        --categories="Development" \
    
      76        --name="${pkgname%-git}" \
    
      77        --exec="${pkgname%-git} %U"
    
      78    _set_build_env
    
      79    _ensure_local_nvm
    
      80    rustup default stable
    
      81    # build nvmd
    
      82    cd "${srcdir}/nvmd.git"
    
      83    cargo install toml-cli
    
      84    cargo build --release
    
      85    # build nvm-desktop
    
      86    cd "${srcdir}/${pkgname%-git}.git"
    
      87    install -Dm755 "${srcdir}/nvmd.git/target/release/nvmd" -t "${srcdir}/${pkgname%-git}.git/src-tauri/resources"
    
      88    sed -i "s/\"active\"\: true\,/\"active\"\: false\,/g" src-tauri/tauri.conf.json
    
      89    cp "src-tauri/icons/128x128@2x.png" "src-tauri/icons/256x256.png"
    
      90    NODE_ENV=development    pnpm install
    
      91}
    
      92build() {
    
      93    cd "${srcdir}/${pkgname%-git}.git"
    
      94    _set_build_env
    
      95    _ensure_local_nvm
    
      96    NODE_ENV=production     pnpm run build
    
      97}
    
      98package() {
    
      99    install -Dm755 "${srcdir}/${pkgname%-git}.git/src-tauri/target/release/${pkgname%-git}" -t "${pkgdir}/usr/bin"
    
      100    install -Dm755 "${srcdir}/nvmd.git/target/release/nvmd" -t "${pkgdir}/usr/lib/${_pkgname//-/ }/resources"
    
      101    install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
      102    _icon_sizes=(32x32 64x64 128x128 256x256)
    
      103    for _icons in "${_icon_sizes[@]}";do
    
      104        install -Dm644 "${srcdir}/${pkgname%-git}.git/src-tauri/icons/${_icons}.png" \
    
      105            "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
    
      106    done
    
      107    install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      108}
    
      109

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
 pkgname=nvm-desktop-git
 _pkgname='NVM Desktop'
-pkgver=4.3.2.r2.g7c743ec
+pkgver=4.4.0.r0.g0eeff7a
 _nodeversion=24
 pkgrel=1
 pkgdesc="A version management desktop client for the Nodejs."
@@ -38,6 +38,30 @@
     git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
     printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
 }
+_set_build_env() {
+    export HOME="${srcdir}/.electron-gyp"
+    export CARGO_HOME="${srcdir}/.cargo"
+    {
+        export PNPM_LINK_WORKSPACE_PACKAGES=true
+        export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
+        export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
+        export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
+        export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
+        export PNPM_SHAMEFULLY_HOIST=true
+        export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
+        export PNPM_NODE_LINKER=hoisted
+        export PNPM_NETWORK_CONCURRENCY=32
+    }
+    if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
+        {
+            export pnpm_config_registry="https://registry.npmmirror.com"
+            export npm_config_registry="https://registry.npmmirror.com"
+            export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
+            export RUSTUP_DIST_SERVER="https://mirrors.aliyun.com/rustup"
+            export RUSTUP_UPDATE_ROOT="https://mirrors.aliyun.com/rustup/rustup"
+        }
+    fi
+}
 _ensure_local_nvm() {
     local NVM_DIR="${srcdir}/.nvm"
     source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
@@ -51,12 +75,8 @@
         --categories="Development" \
         --name="${pkgname%-git}" \
         --exec="${pkgname%-git} %U"
-    export CARGO_HOME="${srcdir}/.cargo"
-    if [ `curl -s ipinfo.io/country | grep CN | wc -l ` -ge 1 ];then
-        export RUSTUP_DIST_SERVER=https://mirrors.ustc.edu.cn/rust-static
-        export RUSTUP_UPDATE_ROOT=https://mirrors.ustc.edu.cn/rust-static/rustup
-        export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
-    fi
+    _set_build_env
+    _ensure_local_nvm
     rustup default stable
     # build nvmd
     cd "${srcdir}/nvmd.git"
@@ -65,24 +85,14 @@
     # build nvm-desktop
     cd "${srcdir}/${pkgname%-git}.git"
     install -Dm755 "${srcdir}/nvmd.git/target/release/nvmd" -t "${srcdir}/${pkgname%-git}.git/src-tauri/resources"
-    HOME="${srcdir}/.electron-gyp"
-    {
-        echo -e '\n'
-        #echo 'build_from_source=true'
-        echo 'link-workspace-packages=true'
-        echo 'fetch-retry-maxtimeout=10000'
-        echo "cache-dir="${srcdir}"/.pnpm_cache"
-        echo "store-dir="${srcdir}"/.pnpm_store"
-    } >> .npmrc
-    _ensure_local_nvm
     sed -i "s/\"active\"\: true\,/\"active\"\: false\,/g" src-tauri/tauri.conf.json
     cp "src-tauri/icons/128x128@2x.png" "src-tauri/icons/256x256.png"
     NODE_ENV=development    pnpm install
 }
 build() {
     cd "${srcdir}/${pkgname%-git}.git"
+    _set_build_env
     _ensure_local_nvm
-    rustup default stable
     NODE_ENV=production     pnpm run build
 }
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 09:37:42	MEDIUM	1
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2