open-design

maintainer Refreeze5911 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command is used to pin a specific version of pnpm (a package manager) from the official npm registry, which is a standard and safe practice in Node.js projects; it does not execute arbitrary or remote code beyond typical package installation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx command is used to pin a specific version of pnpm (a package manager) from the official npm registry, which is a standard and safe practice in Node.js projects; it does not execute arbitrary or remote code beyond typical package installation.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:24 _pnpm() { npx --yes pnpm@10.33.2 "$@"; }

PKGBUILD

1 offending line(s) highlighted

      1pkgname=open-design
    
      2pkgver=0.16.1
    
      3pkgrel=8
    
      4_tag="open-design-v${pkgver}"
    
      5# Upstream CLI name is `od`; this package installs `open-design` because /usr/bin/od is coreutils (octal dump).
    
      6pkgdesc='Local-first design product: design skills and design systems with your code-agent CLI; daemon and static web UI (CLI: open-design).'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/nexu-io/open-design'
    
      9license=('Apache-2.0')
    
      10# Any provider of the nodejs package (mainline or e.g. nodejs-lts-jod); upstream prefers ~24.
    
      11depends=('nodejs')
    
      12makedepends=('python' 'make' 'gcc')
    
      13options=('!strip')
    
      14source=("${url}/archive/refs/tags/${_tag}.tar.gz" 'open-design')
    
      15sha256sums=('d0380e8e8536bd319c1c6cf012b8e10507d0116b82f820e4ef2b7442ed40fa89'
    
      16            'f8fde1bc96045529c0d45a2fd6bcd47fc4f63fe7c07624292113b9e8ff55717c')
    
      17
    
      18_sourcedir="open-design-${_tag}"
    
      19
    
      20build() {
    
      21  cd "${_sourcedir}"
    
      22  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      23  # Corepack is absent on some Node installs (e.g. nodejs-lts-jod); pin pnpm via npx instead.
    
      24  _pnpm() { npx --yes pnpm@10.33.2 "$@"; }
    
      25  _pnpm install --frozen-lockfile --ignore-scripts
    
      26  _pnpm bootstrap
    
      27  _pnpm --filter @open-design/web build
    
      28}
    
      29
    
      30package() {
    
      31  cd "${_sourcedir}"
    
      32  local _dest="${pkgdir}/usr/lib/${pkgname}"
    
      33  install -dm755 "${_dest}"
    
      34  cp -a . "${_dest}/"
    
      35  rm -rf "${_dest}/.git" "${_dest}/e2e" "${_dest}/apps/web/.next"
    
      36
    
      37  install -Dm755 "${srcdir}/open-design" "${pkgdir}/usr/bin/open-design"
    
      38  chmod 755 "${_dest}/apps/daemon/dist/cli.js"
    
      39
    
      40  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      41}
    
      42

Changes since previous scan

--- PKGBUILD @ 2026-07-26 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 pkgname=open-design
 pkgver=0.16.1
-pkgrel=7
+pkgrel=8
 _tag="open-design-v${pkgver}"
 # Upstream CLI name is `od`; this package installs `open-design` because /usr/bin/od is coreutils (octal dump).
 pkgdesc='Local-first design product: design skills and design systems with your code-agent CLI; daemon and static web UI (CLI: open-design).'
@@ -22,9 +22,8 @@
   export ELECTRON_SKIP_BINARY_DOWNLOAD=1
   # Corepack is absent on some Node installs (e.g. nodejs-lts-jod); pin pnpm via npx instead.
   _pnpm() { npx --yes pnpm@10.33.2 "$@"; }
-  _pnpm install --frozen-lockfile
-  _pnpm --filter @open-design/contracts build
-  _pnpm --filter @open-design/daemon build
+  _pnpm install --frozen-lockfile --ignore-scripts
+  _pnpm bootstrap
   _pnpm --filter @open-design/web build
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 09:32:02	MEDIUM	1
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 01:26:42	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 01:22:21	MEDIUM	1
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2