nwjs-bin

maintainer lufog · 56 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a prebuilt SDK tarball from the official nwjs.io release infrastructure (dl.nwjs.io), which is a legitimate and expected source for this software; the host is not whitelisted but plausibly official, and the package only installs binaries and data from it without executing remote code or exfiltrating data.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt SDK tarball from the official nwjs.io release infrastructure (dl.nwjs.io), which is a legitimate and expected source for this software; the host is not whitelisted but plausibly official, and the package only installs binaries and data from it without executing remote code or exfiltrating data.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 nwjs-sdk-$pkgver.tar.gz::https://dl.nwjs.io/v$pkgver/nwjs-sdk-v$pkgver-linux-x64.tar.gz

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aleksey Smirnov <debugger94 at gmail dot com>
    
      2# Contributor: oech3
    
      3# Contributor: Jake <aur@ja-ke.tech>
    
      4# Contributor: Mohammadreza Abdollahzadeh <morealaz at gmail dot com>
    
      5# Contributor: Josia Roßkopf <josia-login@rosskopfs.de>
    
      6# Contributor: Jonas Heinrich <onny@project-insanity.org>
    
      7# Contributor: Yen Chi Hsuan <yan12125 at gmail.com>
    
      8
    
      9pkgbase=nwjs-bin
    
      10pkgname=(
    
      11  nwjs-bin
    
      12  nwjs-sdk-bin
    
      13)
    
      14pkgver=0.113.0
    
      15pkgrel=1
    
      16pkgdesc="Runtime based on Chromium and node.js"
    
      17arch=('x86_64')
    
      18url="https://nwjs.io"
    
      19license=('MIT')
    
      20optdepends=(
    
      21  'nodejs: npm package support'
    
      22  'nw-gyp: native add-on build tool for node-webkit'
    
      23  'nwjs-ffmpeg-codecs: playback of proprietary video/audio'
    
      24)
    
      25options=(!debug)
    
      26source=(
    
      27  nwjs-sdk-$pkgver.tar.gz::https://dl.nwjs.io/v$pkgver/nwjs-sdk-v$pkgver-linux-x64.tar.gz
    
      28  nwjs.png::https://raw.githubusercontent.com/nwjs/website/refs/heads/master/public/img/logo.png
    
      29  nwjs.desktop
    
      30)
    
      31sha256sums=('340e7c6b9fdc0426b5a96fea0df5b93ad671b4e0544dc056fe3227e8b722292d'
    
      32            '0f1643f16302b2e7de66fdf91ae370a65c3811052e0c43a2908d49f60ee5a5e4'
    
      33            '161b2c1a8c429ef0773bd4a7e9a5befd52bf30575c17c7180e9701e77b48950b')
    
      34
    
      35prepare() {
    
      36  # Simplify folder name (only if exists, in case of using '--noextract').
    
      37  if [ -d nwjs-sdk-v$pkgver-linux-x64 ]; then
    
      38    rm -rf nwjs-sdk && mv nwjs-sdk-v$pkgver-linux-x64 nwjs-sdk
    
      39  fi
    
      40}
    
      41
    
      42package_nwjs-bin() {
    
      43  depends=(gtk3 nss libxss)
    
      44  provides=(nwjs node-webkit)
    
      45
    
      46  install -Dm755 "$srcdir"/nwjs-sdk/{chrome_crashpad_handler,nw}         -t "$pkgdir"/opt/nwjs/
    
      47  install -Dm644 "$srcdir"/nwjs-sdk/{icudtl.dat,v8_context_snapshot.bin} -t "$pkgdir"/opt/nwjs/
    
      48  install -Dm644 "$srcdir"/nwjs-sdk/{nw_{100,200}_percent,resources}.pak -t "$pkgdir"/opt/nwjs/
    
      49
    
      50  for d in lib locales; do
    
      51    for f in $(find "$srcdir"/nwjs-sdk/$d -type f -printf "%P\n"); do
    
      52      install -Dm644 "$srcdir"/nwjs-sdk/$d/$f -T "$pkgdir"/opt/nwjs/$d/$f
    
      53    done
    
      54  done
    
      55
    
      56  mkdir -p "$pkgdir"/usr/bin/ && ln -sr "$pkgdir"/opt/nwjs/nw -t "$pkgdir"/usr/bin/
    
      57
    
      58  install -Dm644 "$srcdir"/nwjs.desktop -t "$pkgdir"/usr/share/applications/
    
      59  install -Dm644 "$srcdir"/nwjs.png     -t "$pkgdir"/usr/share/icons/hicolor/128x128/apps/
    
      60}
    
      61
    
      62package_nwjs-sdk-bin() {
    
      63  depends=(nwjs-bin)
    
      64  provides=(nwjs-sdk)
    
      65
    
      66  install -Dm755 "$srcdir"/nwjs-sdk/{chromedriver,minidump_stackwalk,nwjc} -t "$pkgdir"/opt/nwjs/
    
      67
    
      68  mkdir -p "$pkgdir"/usr/bin/ && ln -sr "$pkgdir"/opt/nwjs/nwjc -t "$pkgdir"/usr/bin/
    
      69}
    
      70
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2