open-design

LOW

maintainer Refreeze5911 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx usage fetches a specific version of pnpm (10.33.2) to ensure consistent builds, which is a common and safe practice; it does not execute arbitrary remote code or install untrusted packages.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx usage fetches a specific version of pnpm (10.33.2) to ensure consistent builds, which is a common and safe practice; it does not execute arbitrary remote code or install untrusted packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:24 _pnpm() { npx --yes pnpm@10.33.2 "$@"; }

PKGBUILD

1 offending line(s) highlighted

      1pkgname=open-design
    
      2pkgver=0.22.1
    
      3pkgrel=8
    
      4_tag="open-design-v${pkgver}"
    
      5# Upstream CLI name is `od`; this package installs `open-design` because /usr/bin/od is coreutils (octal dump).
    
      6pkgdesc='Local-first design product: design skills and design systems with your code-agent CLI; daemon and static web UI (CLI: open-design).'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/nexu-io/open-design'
    
      9license=('Apache-2.0')
    
      10# Any provider of the nodejs package (mainline or e.g. nodejs-lts-jod); upstream prefers ~24.
    
      11depends=('nodejs')
    
      12makedepends=('python' 'make' 'gcc')
    
      13options=('!strip')
    
      14source=("${url}/archive/refs/tags/${_tag}.tar.gz" 'open-design')
    
      15sha256sums=('4b02c12458c9367fd043e06c4a91a520df76f66a8eea64f7da40509957fcc7b2'
    
      16            'f8fde1bc96045529c0d45a2fd6bcd47fc4f63fe7c07624292113b9e8ff55717c')
    
      17
    
      18_sourcedir="open-design-${_tag}"
    
      19
    
      20build() {
    
      21  cd "${_sourcedir}"
    
      22  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      23  # Corepack is absent on some Node installs (e.g. nodejs-lts-jod); pin pnpm via npx instead.
    
      24  _pnpm() { npx --yes pnpm@10.33.2 "$@"; }
    
      25  _pnpm install --frozen-lockfile --ignore-scripts
    
      26  _pnpm bootstrap
    
      27  _pnpm --filter @open-design/web build
    
      28}
    
      29
    
      30package() {
    
      31  cd "${_sourcedir}"
    
      32  local _dest="${pkgdir}/usr/lib/${pkgname}"
    
      33  install -dm755 "${_dest}"
    
      34  cp -a . "${_dest}/"
    
      35  rm -rf "${_dest}/.git" "${_dest}/e2e" "${_dest}/apps/web/.next"
    
      36
    
      37  install -Dm755 "${srcdir}/open-design" "${pkgdir}/usr/bin/open-design"
    
      38  chmod 755 "${_dest}/apps/daemon/dist/cli.js"
    
      39
    
      40  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      41}
    
      42

Changes since previous scan

--- PKGBUILD @ 2026-09-10 00:22
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,5 +1,5 @@
 pkgname=open-design
-pkgver=0.22.0
+pkgver=0.22.1
 pkgrel=8
 _tag="open-design-v${pkgver}"
 # Upstream CLI name is `od`; this package installs `open-design` because /usr/bin/od is coreutils (octal dump).
@@ -12,7 +12,7 @@
 makedepends=('python' 'make' 'gcc')
 options=('!strip')
 source=("${url}/archive/refs/tags/${_tag}.tar.gz" 'open-design')
-sha256sums=('b551586bb0eaf68a5a806d14ba4d1c5f5591eb7820be25e4f4396bf1d86abf7a'
+sha256sums=('4b02c12458c9367fd043e06c4a91a520df76f66a8eea64f7da40509957fcc7b2'
             'f8fde1bc96045529c0d45a2fd6bcd47fc4f63fe7c07624292113b9e8ff55717c')
 
 _sourcedir="open-design-${_tag}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 15:20:39	Medium	1
2026-09-10 00:22:44	Low	2
2026-09-09 15:19:51	Medium	1
2026-09-09 00:04:09	Low	2
2026-09-08 15:17:32	Medium	1
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2