open-design-desktop

MEDIUM

maintainer NickeyGod 0 votes scanned 2026-09-05 16:04:04.162047

View on AUR

Why flagged

The build uses `npx --yes pnpm@10.33.2` to fetch and run pnpm from npm at build time (pinned version but still a remote package execution), then builds and runs an AppImage extracted in-place; the AppImage is built from the project's own source tarball with a verified checksum, but the npx-fetched toolchain and the AppImage self-extraction/execution during packaging introduce unverifiable remote code execution steps beyond what a normal source build requires.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:48 _pnpm() { npx --yes pnpm@10.33.2 "$@"; }

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): The build uses `npx --yes pnpm@10.33.2` to fetch and run pnpm from npm at build time (pinned version but still a remote package execution), then builds and runs an AppImage extracted in-place; the AppImage is built from the project's own source tarball with a verified checksum, but the npx-fetched toolchain and the AppImage self-extraction/execution during packaging introduce unverifiable remote code execution steps beyond what a normal source build requires.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: NickeyGod <niklass.schaeffer@gmail.com>
    
      2
    
      3pkgname=open-design-desktop
    
      4pkgver=0.21.1
    
      5pkgrel=1
    
      6_tag="open-design-v${pkgver}"
    
      7pkgdesc='Local-first design product: native desktop app & canvas for coding agents (the open-source Claude Design alternative)'
    
      8arch=('x86_64')
    
      9url='https://github.com/nexu-io/open-design'
    
      10license=('Apache-2.0')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'gtk3'
    
      14  'libnotify'
    
      15  'libxss'
    
      16  'libxtst'
    
      17  'nss'
    
      18  'xdg-utils'
    
      19)
    
      20makedepends=(
    
      21  'git'
    
      22  'nodejs'
    
      23  'npm'
    
      24  'python'
    
      25  'make'
    
      26  'gcc'
    
      27)
    
      28provides=('open-design' 'open-design-desktop')
    
      29conflicts=('open-design' 'open-design-git')
    
      30options=('!strip' '!debug')
    
      31
    
      32source=(
    
      33  "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/${_tag}.tar.gz"
    
      34  "open-design-desktop.sh"
    
      35  "open-design-desktop.desktop"
    
      36)
    
      37sha256sums=(
    
      38  'f6cc90f03b3c135fb4e1c853de7f4630a338a7dbd9a53f9a58cb294aba21fca7'
    
      39  '5ae2dfc1943cd7ec376a5c42086cb76b618f14e10c7e92ecbf901f376b6eea6e'
    
      40  '7f86112fce365ab0bc6cc5f7cd415b4bace62c1c2d6252584100b7580290ddd6'
    
      41)
    
      42
    
      43_sourcedir="open-design-${_tag}"
    
      44
    
      45build() {
    
      46  cd "${srcdir}/${_sourcedir}"
    
      47
    
      48  _pnpm() { npx --yes pnpm@10.33.2 "$@"; }
    
      49
    
      50  _pnpm install --frozen-lockfile
    
      51  _pnpm tools-pack linux build --to appimage --namespace aur --portable --dir "${srcdir}/tools-pack"
    
      52}
    
      53
    
      54package() {
    
      55  cd "${srcdir}/${_sourcedir}"
    
      56
    
      57  local _appimage _extract_dir
    
      58  _appimage="$(find "${srcdir}/tools-pack/out/linux/namespaces/aur/builder" -maxdepth 1 -type f -name '*.AppImage' -print -quit)"
    
      59  if [[ -z "${_appimage}" ]]; then
    
      60    echo "Error: no AppImage found under ${srcdir}/tools-pack/out/linux/namespaces/aur/builder" >&2
    
      61    return 1
    
      62  fi
    
      63
    
      64  _extract_dir="${srcdir}/open-design-appdir"
    
      65  rm -rf "${_extract_dir}"
    
      66  mkdir -p "${_extract_dir}"
    
      67  (cd "${_extract_dir}" && "${_appimage}" --appimage-extract > /dev/null)
    
      68
    
      69  mkdir -p "${pkgdir}/opt/${pkgname}/appdir"
    
      70  cp -a "${_extract_dir}/squashfs-root/." "${pkgdir}/opt/${pkgname}/appdir/"
    
      71  chmod -R u+rwX,go+rX "${pkgdir}/opt/${pkgname}/appdir"
    
      72
    
      73  # Binaries
    
      74  install -Dm755 "${srcdir}/open-design-desktop.sh" "${pkgdir}/usr/bin/open-design-desktop"
    
      75  ln -sf "open-design-desktop" "${pkgdir}/usr/bin/open-design"
    
      76
    
      77  # Desktop entry & Icon
    
      78  install -Dm644 "${srcdir}/open-design-desktop.desktop" "${pkgdir}/usr/share/applications/open-design-desktop.desktop"
    
      79  install -Dm644 tools/pack/resources/linux/icon.png "${pkgdir}/usr/share/icons/hicolor/512x512/apps/open-design.png"
    
      80
    
      81  # License
    
      82  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      83}
    
      84

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-05 16:04:04	Medium	3
2026-09-05 16:00:23	Medium	2