openai-codex-desktop

maintainer parsiad · 7 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads and executes remote Node.js packages via npx (asar, @electron/rebuild) and includes sources from non-standard hosts (persistent.oaistatic.com, npm registry), posing a supply-chain risk if those sources are compromised.

Triggered rules

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:80 npx --yes asar extract \
PKGBUILD:141 npx --yes @electron/rebuild -v "${_electron_major}.0.0" --force
PKGBUILD:163 npx --yes asar pack app-extracted app.asar --unpack "{*.node,*.so}"

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 "${_upstream_app}-${pkgver}.zip::https://persistent.oaistatic.com/codex-app-prod/${_upstream_app}-darwin-arm64-${pkgver}.zip"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads and executes remote Node.js packages via npx (asar, @electron/rebuild) and includes sources from non-standard hosts (persistent.oaistatic.com, npm registry), posing a supply-chain risk if those sources are compromised.

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Parsiad Azimzadeh <parsiad.azimzadeh at gmail dot com>
    
      2# Maintainer: mothran
    
      3# Releases: https://persistent.oaistatic.com/codex-app-prod/appcast.xml
    
      4
    
      5pkgname=openai-codex-desktop
    
      6pkgver=26.707.31428
    
      7pkgrel=1
    
      8pkgdesc="OpenAI Codex desktop app"
    
      9arch=('x86_64')
    
      10url="https://developers.openai.com/codex/app/"
    
      11license=('custom')
    
      12
    
      13depends=(
    
      14  'electron42'
    
      15  'openai-codex'
    
      16  'python'
    
      17  'hicolor-icon-theme'
    
      18  'xdg-utils'
    
      19)
    
      20
    
      21makedepends=(
    
      22  'libicns'
    
      23  'libarchive'
    
      24  'nodejs'
    
      25  'npm'
    
      26)
    
      27
    
      28_electron_major=42
    
      29_better_sqlite3_ver=12.9.0
    
      30_node_pty_ver=1.1.0
    
      31_upstream_app=ChatGPT
    
      32
    
      33source=(
    
      34  "${_upstream_app}-${pkgver}.zip::https://persistent.oaistatic.com/codex-app-prod/${_upstream_app}-darwin-arm64-${pkgver}.zip"
    
      35  "better-sqlite3.tgz::https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-${_better_sqlite3_ver}.tgz"
    
      36  "node-pty.tgz::https://registry.npmjs.org/node-pty/-/node-pty-${_node_pty_ver}.tgz"
    
      37  "codex-desktop.sh"
    
      38  "Codex.desktop"
    
      39  "patch-linux-open-targets.mjs"
    
      40  "patch-linux-opaque-bg.mjs"
    
      41)
    
      42
    
      43noextract=(
    
      44  "${_upstream_app}-${pkgver}.zip"
    
      45  'better-sqlite3.tgz'
    
      46  'node-pty.tgz'
    
      47)
    
      48
    
      49sha256sums=('ffdc351a507105d55d7464e3340302c758b8a54b926711c4b15bf373ccb47d64'
    
      50            'ad0e29650140c49d0335b1d356596aa8166f12b758f418a98446130e3278f250'
    
      51            'c7517f19083ddcb05f276904680eb2b11a6b5ecab778b8e4e5685a6d645b3f60'
    
      52            '8f5d55f92df1d5a29c73fb97e73e35ca4de67cb0ce0ee8ffc8d0b99020a8ab41'
    
      53            '568228ade14afa0afd43eea6887547b7541e45e8438042367f628c5dae3aa810'
    
      54            'b9303b892b3e0b35333e2cb96052905439105049efc5a8a3706e22a16dc30018'
    
      55            'a181ace049a057654acdd789df60ee0f2b0435a119f8a2c53046bfe6aa4c4cb9')
    
      56
    
      57prepare() {
    
      58  cd "${srcdir}"
    
      59  rm -rf dmg app-extracted app.asar app.asar.unpacked native-build
    
      60  mkdir dmg
    
      61
    
      62  bsdtar -xf "${_upstream_app}-${pkgver}.zip" -C "${srcdir}/dmg"
    
      63
    
      64  local appdir
    
      65  appdir="$(find dmg -maxdepth 4 -type d -name '*.app' ! -path '*/__MACOSX/*' | head -n1)"
    
      66  [[ -n "${appdir}" ]] || {
    
      67    echo "Could not find .app bundle in ${_upstream_app} archive"
    
      68    return 1
    
      69  }
    
      70
    
      71  local icon_icns
    
      72  icon_icns="$(find "${appdir}/Contents/Resources" -maxdepth 1 -type f -name '*.icns' ! -name '._*' -print -quit)"
    
      73  [[ -n "${icon_icns}" ]] || {
    
      74    echo "Could not find application icon in ${appdir}"
    
      75    return 1
    
      76  }
    
      77  mkdir -p icon
    
      78  icns2png -x -o icon "${icon_icns}"
    
      79
    
      80  npx --yes asar extract \
    
      81    "${appdir}/Contents/Resources/app.asar" \
    
      82    app-extracted
    
      83
    
      84  [[ -d "${appdir}/Contents/Resources/app.asar.unpacked" ]] &&
    
      85    cp -a "${appdir}/Contents/Resources/app.asar.unpacked" .
    
      86
    
      87  rm -rf app-extracted/node_modules/sparkle-darwin
    
      88  find app-extracted -type f \( -name '*.dylib' -o -name 'sparkle.node' \) -delete
    
      89
    
      90  node "${srcdir}/patch-linux-open-targets.mjs" app-extracted
    
      91  node "${srcdir}/patch-linux-opaque-bg.mjs" app-extracted
    
      92
    
      93  local bs3_ver npty_ver
    
      94  bs3_ver="$(node -p "require('${srcdir}/app-extracted/node_modules/better-sqlite3/package.json').version")"
    
      95  npty_ver="$(node -p "require('${srcdir}/app-extracted/node_modules/node-pty/package.json').version")"
    
      96
    
      97  [[ "${bs3_ver}" == "${_better_sqlite3_ver}" ]] || {
    
      98    echo "better-sqlite3 version mismatch: app=${bs3_ver}, pkgbuild=${_better_sqlite3_ver}"
    
      99    return 1
    
      100  }
    
      101
    
      102  [[ "${npty_ver}" == "${_node_pty_ver}" ]] || {
    
      103    echo "node-pty version mismatch: app=${npty_ver}, pkgbuild=${_node_pty_ver}"
    
      104    return 1
    
      105  }
    
      106
    
      107  mkdir native-build
    
      108  cd native-build
    
      109
    
      110  cat >package.json <<'EOF'
    
      111{
    
      112  "name": "codex-desktop-native-rebuild",
    
      113  "private": true,
    
      114  "license": "UNLICENSED"
    
      115}
    
      116EOF
    
      117
    
      118  npm install \
    
      119    --ignore-scripts \
    
      120    --no-audit \
    
      121    --no-fund \
    
      122    "${srcdir}/better-sqlite3.tgz" \
    
      123    "${srcdir}/node-pty.tgz"
    
      124
    
      125  local bs3_src=node_modules/better-sqlite3/src
    
      126  sed -i \
    
      127    's/v8::External::New(isolate, addon)/v8::External::New(isolate, addon, v8::kExternalPointerTypeTagDefault)/' \
    
      128    "${bs3_src}/better_sqlite3.cpp"
    
      129  sed -i \
    
      130    's/v8::External>()->Value()/v8::External>()->Value(v8::kExternalPointerTypeTagDefault)/' \
    
      131    "${bs3_src}/util/macros.cpp"
    
      132  sed -i \
    
      133    '/SetNativeDataProperty/,/);/{s/\t\t0,/\t\tnullptr,/}' \
    
      134    "${bs3_src}/util/helpers.cpp"
    
      135
    
      136  export npm_config_runtime=electron
    
      137  export npm_config_target="${_electron_major}.0.0"
    
      138  export npm_config_disturl="https://electronjs.org/headers"
    
      139  export npm_config_build_from_source=true
    
      140
    
      141  npx --yes @electron/rebuild -v "${_electron_major}.0.0" --force
    
      142
    
      143  rm -rf "${srcdir}/app-extracted/node_modules/better-sqlite3"
    
      144  rm -rf "${srcdir}/app-extracted/node_modules/node-pty"
    
      145  cp -a node_modules/better-sqlite3 "${srcdir}/app-extracted/node_modules/"
    
      146  cp -a node_modules/node-pty "${srcdir}/app-extracted/node_modules/"
    
      147
    
      148  cd "${srcdir}"
    
      149  find app-extracted/node_modules/better-sqlite3 app-extracted/node_modules/node-pty \
    
      150    -type f \( -name Makefile -o -name '*.mk' -o -name config.gypi \) -delete
    
      151  find app-extracted/node_modules/better-sqlite3 app-extracted/node_modules/node-pty \
    
      152    -type d -name .deps -prune -exec rm -rf '{}' +
    
      153
    
      154  local prebuild_root
    
      155  for prebuild_root in app-extracted app.asar.unpacked; do
    
      156    [[ -d "${prebuild_root}" ]] || continue
    
      157    find "${prebuild_root}" -path '*/prebuilds/*' -type f -name '*.node' \
    
      158      ! \( -path '*/linux-x64/*' -o -path '*/HID-linux-x64/*' -o -path '*/HID_hidraw-linux-x64/*' \) \
    
      159      -delete
    
      160    find "${prebuild_root}" -path '*/prebuilds/*' -type f -name '*musl*.node' -delete
    
      161  done
    
      162
    
      163  npx --yes asar pack app-extracted app.asar --unpack "{*.node,*.so}"
    
      164}
    
      165
    
      166package() {
    
      167  cd "${srcdir}"
    
      168
    
      169  install -Dm644 app.asar \
    
      170    "${pkgdir}/usr/lib/${pkgname}/resources/app.asar"
    
      171
    
      172  if [[ -d app.asar.unpacked ]]; then
    
      173    cp -a app.asar.unpacked \
    
      174      "${pkgdir}/usr/lib/${pkgname}/resources/"
    
      175  fi
    
      176
    
      177  if [[ -d app-extracted/webview ]]; then
    
      178    mkdir -p "${pkgdir}/usr/lib/${pkgname}/content"
    
      179    cp -a app-extracted/webview \
    
      180      "${pkgdir}/usr/lib/${pkgname}/content/"
    
      181  fi
    
      182
    
      183  ln -s "/usr/lib/electron${_electron_major}/electron" \
    
      184    "${pkgdir}/usr/lib/${pkgname}/codex"
    
      185
    
      186  install -Dm755 codex-desktop.sh \
    
      187    "${pkgdir}/usr/bin/codex-desktop"
    
      188
    
      189  local icon_png
    
      190  icon_png="$(find icon -maxdepth 1 -type f -name '*512x512*.png' -print -quit)"
    
      191  [[ -n "${icon_png}" ]] ||
    
      192    icon_png="$(find icon -maxdepth 1 -type f -name '*.png' -print | sort -V | tail -n1)"
    
      193  [[ -n "${icon_png}" ]] || {
    
      194    echo "Could not find an application icon to package"
    
      195    return 1
    
      196  }
    
      197
    
      198  install -Dm644 "${icon_png}" \
    
      199    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/openai-codex-desktop.png"
    
      200
    
      201  install -Dm644 Codex.desktop \
    
      202    "${pkgdir}/usr/share/applications/Codex.desktop"
    
      203}
    
      204

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 23:36:42	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3