nwjs-sdk-bin
LOW
maintainer lufog
56 votes
base
nwjs-bin
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt SDK from the official project's release infrastructure (dl.nwjs.io), which is a standard and expected source for this software; the non-whitelisted host is the project's own domain, so the download is legitimate and the build process installs expected binaries without obfuscation or remote code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt SDK from the official project's release infrastructure (dl.nwjs.io), which is a standard and expected source for this software; the non-whitelisted host is the project's own domain, so the download is legitimate and the build process installs expected binaries without obfuscation or remote code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:27
nwjs-sdk-$pkgver.tar.gz::https://dl.nwjs.io/v$pkgver/nwjs-sdk-v$pkgver-linux-x64.tar.gz
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Aleksey Smirnov <debugger94 at gmail dot com>
2
# Contributor: oech3
3
# Contributor: Jake <aur@ja-ke.tech>
4
# Contributor: Mohammadreza Abdollahzadeh <morealaz at gmail dot com>
5
# Contributor: Josia Roßkopf <josia-login@rosskopfs.de>
6
# Contributor: Jonas Heinrich <onny@project-insanity.org>
7
# Contributor: Yen Chi Hsuan <yan12125 at gmail.com>
8
9
pkgbase=nwjs-bin
10
pkgname=(
11
nwjs-bin
12
nwjs-sdk-bin
13
)
14
pkgver=0.116.0
15
pkgrel=1
16
pkgdesc="Runtime based on Chromium and node.js"
17
arch=('x86_64')
18
url="https://nwjs.io"
19
license=('MIT')
20
optdepends=(
21
'nodejs: npm package support'
22
'nw-gyp: native add-on build tool for node-webkit'
23
'nwjs-ffmpeg-codecs: playback of proprietary video/audio'
24
)
25
options=(!debug)
26
source=(
27
nwjs-sdk-$pkgver.tar.gz::https://dl.nwjs.io/v$pkgver/nwjs-sdk-v$pkgver-linux-x64.tar.gz
28
nwjs.png::https://raw.githubusercontent.com/nwjs/website/refs/heads/master/public/img/logo.png
29
nwjs.desktop
30
)
31
sha256sums=('f1518f6f20abd43b00fd8c5bd527353063f5d738bf7aec03167bb82395720225'
32
'0f1643f16302b2e7de66fdf91ae370a65c3811052e0c43a2908d49f60ee5a5e4'
33
'161b2c1a8c429ef0773bd4a7e9a5befd52bf30575c17c7180e9701e77b48950b')
34
35
prepare() {
36
# Simplify folder name (only if exists, in case of using '--noextract').
37
if [ -d nwjs-sdk-v$pkgver-linux-x64 ]; then
38
rm -rf nwjs-sdk && mv nwjs-sdk-v$pkgver-linux-x64 nwjs-sdk
39
fi
40
}
41
42
package_nwjs-bin() {
43
depends=(gtk3 nss libxss)
44
provides=(nwjs node-webkit)
45
46
install -Dm755 "$srcdir"/nwjs-sdk/{chrome_crashpad_handler,nw} -t "$pkgdir"/opt/nwjs/
47
install -Dm644 "$srcdir"/nwjs-sdk/{icudtl.dat,v8_context_snapshot.bin} -t "$pkgdir"/opt/nwjs/
48
install -Dm644 "$srcdir"/nwjs-sdk/{nw_{100,200}_percent,resources}.pak -t "$pkgdir"/opt/nwjs/
49
50
for d in lib locales; do
51
for f in $(find "$srcdir"/nwjs-sdk/$d -type f -printf "%P\n"); do
52
install -Dm644 "$srcdir"/nwjs-sdk/$d/$f -T "$pkgdir"/opt/nwjs/$d/$f
53
done
54
done
55
56
mkdir -p "$pkgdir"/usr/bin/ && ln -sr "$pkgdir"/opt/nwjs/nw -t "$pkgdir"/usr/bin/
57
58
install -Dm644 "$srcdir"/nwjs.desktop -t "$pkgdir"/usr/share/applications/
59
install -Dm644 "$srcdir"/nwjs.png -t "$pkgdir"/usr/share/icons/hicolor/128x128/apps/
60
}
61
62
package_nwjs-sdk-bin() {
63
depends=(nwjs-bin)
64
provides=(nwjs-sdk)
65
66
install -Dm755 "$srcdir"/nwjs-sdk/{chromedriver,minidump_stackwalk,nwjc} -t "$pkgdir"/opt/nwjs/
67
68
mkdir -p "$pkgdir"/usr/bin/ && ln -sr "$pkgdir"/opt/nwjs/nwjc -t "$pkgdir"/usr/bin/
69
}
70
71
Changes since previous scan
--- PKGBUILD @ 2026-09-14 00:27+++ PKGBUILD @ 2026-09-17 00:27@@ -11,7 +11,7 @@ nwjs-bin nwjs-sdk-bin )-pkgver=0.114.1+pkgver=0.116.0 pkgrel=1 pkgdesc="Runtime based on Chromium and node.js" arch=('x86_64')@@ -28,7 +28,7 @@ nwjs.png::https://raw.githubusercontent.com/nwjs/website/refs/heads/master/public/img/logo.png nwjs.desktop )-sha256sums=('8e2d70c877747d3748165518da79628763165bf73f7c506469c0cb86226c433e'+sha256sums=('f1518f6f20abd43b00fd8c5bd527353063f5d738bf7aec03167bb82395720225' '0f1643f16302b2e7de66fdf91ae370a65c3811052e0c43a2908d49f60ee5a5e4' '161b2c1a8c429ef0773bd4a7e9a5befd52bf30575c17c7180e9701e77b48950b') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 13:17:35 | Medium | 1 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |