nwjs-bin

LOW

maintainer lufog 56 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt SDK from the official project's release infrastructure (dl.nwjs.io), which is a standard and expected source for this software; the non-whitelisted host is the project's own domain, so the download is legitimate and the build process installs expected binaries without obfuscation or remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt SDK from the official project's release infrastructure (dl.nwjs.io), which is a standard and expected source for this software; the non-whitelisted host is the project's own domain, so the download is legitimate and the build process installs expected binaries without obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 nwjs-sdk-$pkgver.tar.gz::https://dl.nwjs.io/v$pkgver/nwjs-sdk-v$pkgver-linux-x64.tar.gz

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aleksey Smirnov <debugger94 at gmail dot com>
    
      2# Contributor: oech3
    
      3# Contributor: Jake <aur@ja-ke.tech>
    
      4# Contributor: Mohammadreza Abdollahzadeh <morealaz at gmail dot com>
    
      5# Contributor: Josia Roßkopf <josia-login@rosskopfs.de>
    
      6# Contributor: Jonas Heinrich <onny@project-insanity.org>
    
      7# Contributor: Yen Chi Hsuan <yan12125 at gmail.com>
    
      8
    
      9pkgbase=nwjs-bin
    
      10pkgname=(
    
      11  nwjs-bin
    
      12  nwjs-sdk-bin
    
      13)
    
      14pkgver=0.116.0
    
      15pkgrel=1
    
      16pkgdesc="Runtime based on Chromium and node.js"
    
      17arch=('x86_64')
    
      18url="https://nwjs.io"
    
      19license=('MIT')
    
      20optdepends=(
    
      21  'nodejs: npm package support'
    
      22  'nw-gyp: native add-on build tool for node-webkit'
    
      23  'nwjs-ffmpeg-codecs: playback of proprietary video/audio'
    
      24)
    
      25options=(!debug)
    
      26source=(
    
      27  nwjs-sdk-$pkgver.tar.gz::https://dl.nwjs.io/v$pkgver/nwjs-sdk-v$pkgver-linux-x64.tar.gz
    
      28  nwjs.png::https://raw.githubusercontent.com/nwjs/website/refs/heads/master/public/img/logo.png
    
      29  nwjs.desktop
    
      30)
    
      31sha256sums=('f1518f6f20abd43b00fd8c5bd527353063f5d738bf7aec03167bb82395720225'
    
      32            '0f1643f16302b2e7de66fdf91ae370a65c3811052e0c43a2908d49f60ee5a5e4'
    
      33            '161b2c1a8c429ef0773bd4a7e9a5befd52bf30575c17c7180e9701e77b48950b')
    
      34
    
      35prepare() {
    
      36  # Simplify folder name (only if exists, in case of using '--noextract').
    
      37  if [ -d nwjs-sdk-v$pkgver-linux-x64 ]; then
    
      38    rm -rf nwjs-sdk && mv nwjs-sdk-v$pkgver-linux-x64 nwjs-sdk
    
      39  fi
    
      40}
    
      41
    
      42package_nwjs-bin() {
    
      43  depends=(gtk3 nss libxss)
    
      44  provides=(nwjs node-webkit)
    
      45
    
      46  install -Dm755 "$srcdir"/nwjs-sdk/{chrome_crashpad_handler,nw}         -t "$pkgdir"/opt/nwjs/
    
      47  install -Dm644 "$srcdir"/nwjs-sdk/{icudtl.dat,v8_context_snapshot.bin} -t "$pkgdir"/opt/nwjs/
    
      48  install -Dm644 "$srcdir"/nwjs-sdk/{nw_{100,200}_percent,resources}.pak -t "$pkgdir"/opt/nwjs/
    
      49
    
      50  for d in lib locales; do
    
      51    for f in $(find "$srcdir"/nwjs-sdk/$d -type f -printf "%P\n"); do
    
      52      install -Dm644 "$srcdir"/nwjs-sdk/$d/$f -T "$pkgdir"/opt/nwjs/$d/$f
    
      53    done
    
      54  done
    
      55
    
      56  mkdir -p "$pkgdir"/usr/bin/ && ln -sr "$pkgdir"/opt/nwjs/nw -t "$pkgdir"/usr/bin/
    
      57
    
      58  install -Dm644 "$srcdir"/nwjs.desktop -t "$pkgdir"/usr/share/applications/
    
      59  install -Dm644 "$srcdir"/nwjs.png     -t "$pkgdir"/usr/share/icons/hicolor/128x128/apps/
    
      60}
    
      61
    
      62package_nwjs-sdk-bin() {
    
      63  depends=(nwjs-bin)
    
      64  provides=(nwjs-sdk)
    
      65
    
      66  install -Dm755 "$srcdir"/nwjs-sdk/{chromedriver,minidump_stackwalk,nwjc} -t "$pkgdir"/opt/nwjs/
    
      67
    
      68  mkdir -p "$pkgdir"/usr/bin/ && ln -sr "$pkgdir"/opt/nwjs/nwjc -t "$pkgdir"/usr/bin/
    
      69}
    
      70
    
      71

Changes since previous scan

--- PKGBUILD @ 2026-09-14 00:27
+++ PKGBUILD @ 2026-09-17 00:27
@@ -11,7 +11,7 @@
   nwjs-bin
   nwjs-sdk-bin
 )
-pkgver=0.114.1
+pkgver=0.116.0
 pkgrel=1
 pkgdesc="Runtime based on Chromium and node.js"
 arch=('x86_64')
@@ -28,7 +28,7 @@
   nwjs.png::https://raw.githubusercontent.com/nwjs/website/refs/heads/master/public/img/logo.png
   nwjs.desktop
 )
-sha256sums=('8e2d70c877747d3748165518da79628763165bf73f7c506469c0cb86226c433e'
+sha256sums=('f1518f6f20abd43b00fd8c5bd527353063f5d738bf7aec03167bb82395720225'
             '0f1643f16302b2e7de66fdf91ae370a65c3811052e0c43a2908d49f60ee5a5e4'
             '161b2c1a8c429ef0773bd4a7e9a5befd52bf30575c17c7180e9701e77b48950b')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 13:17:35	Medium	1
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2