open-design

LOW

maintainer Refreeze5911 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The npx usage installs a specific version of pnpm (10.33.2) to bootstrap the build, which is a common and safe practice; the source is the project's own repository, and no untrusted remote code is executed beyond standard build processes.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx usage installs a specific version of pnpm (10.33.2) to bootstrap the build, which is a common and safe practice; the source is the project's own repository, and no untrusted remote code is executed beyond standard build processes.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:25 _pnpm() { npx --yes pnpm@10.33.2 "$@"; }

PKGBUILD

1 offending line(s) highlighted

      1pkgname=open-design
    
      2pkgver=0.26.0
    
      3pkgrel=9
    
      4_tag="open-design-v${pkgver}"
    
      5# Upstream CLI name is `od`; this package installs `open-design` because /usr/bin/od is coreutils (octal dump).
    
      6pkgdesc='Local-first design product: design skills and design systems with your code-agent CLI; daemon and static web UI (CLI: open-design).'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/nexu-io/open-design'
    
      9license=('Apache-2.0')
    
      10depends=('nodejs' 'node-gyp' 'python' 'make' 'gcc')
    
      11makedepends=('npm')
    
      12options=('!strip' '!debug')
    
      13source=("${url}/archive/refs/tags/${_tag}.tar.gz" 'open-design' 'open-design-rebuild-native' 'open-design-nodejs.hook')
    
      14sha256sums=('d1db8ad141fe053401467d1da1e59c75f72eb188225bf6c2900d1f3b7c114dcf'
    
      15            '6d0dbacec1ef6e27725d04aee28221cb7ba4f1b39ed15c10efdf499540157bd5'
    
      16            'b5b254f77ed0f8a8b89909f561088298d34d7f4ee57c5dc18ef3901bb43c5ee7'
    
      17            'aba727989d9c776fea7c8ac3888d1129bab5b8d6d861dbefb31fb703e30cef04')
    
      18
    
      19_sourcedir="open-design-${_tag}"
    
      20
    
      21build() {
    
      22  cd "${_sourcedir}"
    
      23  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      24  # Corepack is not guaranteed to be installed; pin pnpm via npx.
    
      25  _pnpm() { npx --yes pnpm@10.33.2 "$@"; }
    
      26  _pnpm install --frozen-lockfile --ignore-scripts
    
      27  # Compile against the system Node used by the installed launcher.
    
      28  npm run build-release --prefix apps/daemon/node_modules/better-sqlite3 -- --nodedir=/usr
    
      29  /usr/bin/node -e "require('./apps/daemon/node_modules/better-sqlite3')(':memory:').close()"
    
      30  _pnpm bootstrap
    
      31  _pnpm --filter @open-design/web build
    
      32}
    
      33
    
      34package() {
    
      35  cd "${_sourcedir}"
    
      36  local _dest="${pkgdir}/usr/lib/${pkgname}"
    
      37  install -dm755 "${_dest}"
    
      38  cp -a . "${_dest}/"
    
      39  rm -rf "${_dest}/.git" "${_dest}/e2e" "${_dest}/apps/web/.next"
    
      40
    
      41  install -Dm755 "${srcdir}/open-design" "${pkgdir}/usr/bin/open-design"
    
      42  install -Dm755 "${srcdir}/open-design-rebuild-native" "${pkgdir}/usr/lib/${pkgname}/rebuild-native"
    
      43  install -Dm644 "${srcdir}/open-design-nodejs.hook" "${pkgdir}/usr/share/libalpm/hooks/open-design-nodejs.hook"
    
      44  chmod 755 "${_dest}/apps/daemon/dist/cli.js"
    
      45
    
      46  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-10-22 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,5 +1,5 @@
 pkgname=open-design
-pkgver=0.25.0
+pkgver=0.26.0
 pkgrel=9
 _tag="open-design-v${pkgver}"
 # Upstream CLI name is `od`; this package installs `open-design` because /usr/bin/od is coreutils (octal dump).
@@ -11,7 +11,7 @@
 makedepends=('npm')
 options=('!strip' '!debug')
 source=("${url}/archive/refs/tags/${_tag}.tar.gz" 'open-design' 'open-design-rebuild-native' 'open-design-nodejs.hook')
-sha256sums=('f1421c076d6f033642949f793814fc84a04d1a11c6169b7581df6abc93745ea6'
+sha256sums=('d1db8ad141fe053401467d1da1e59c75f72eb188225bf6c2900d1f3b7c114dcf'
             '6d0dbacec1ef6e27725d04aee28221cb7ba4f1b39ed15c10efdf499540157bd5'
             'b5b254f77ed0f8a8b89909f561088298d34d7f4ee57c5dc18ef3901bb43c5ee7'
             'aba727989d9c776fea7c8ac3888d1129bab5b8d6d861dbefb31fb703e30cef04')

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 15:35:25	Medium	1
2026-10-22 00:13:10	Low	2
2026-10-21 03:30:06	Medium	1
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 03:14:05	Medium	1
2026-10-16 00:12:47	Low	2