opensquilla

MEDIUM

maintainer duanluan 0 votes scanned 2026-09-05 04:00:58.693725

View on AUR

Why flagged

The PKGBUILD repackages a macOS DMG for Linux use with electron42. The two flagged `npx --yes asar` calls download and execute the `asar` npm package at build time without a pinned version or integrity check, which is a supply-chain risk (an attacker who compromises the `asar` npm package could execute arbitrary code during the build). However, this is a well-known, widely-used Electron tooling package and the pattern is common in AUR electron repacks. The actual source files come from a GitHub releases page with sha256sums (the DMG and whl are checksummed; the gateway script has SKIP which is mildly concerning but it's a local file). The Python inline scripts perform straightforward text substitution and icon conversion with no obfuscation. The whl file is installed as a data file (not executed at build time). The main concern is the unpinned `npx --yes asar` fetching from npm at build time without a hash, which is a real but moderate supply-chain risk rather than active malware. Overall this is medium risk due to the unpinned remote npm package execution during build, not high.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it MEDIUM (confidence 72%): The PKGBUILD repackages a macOS DMG for Linux use with electron42. The two flagged `npx --yes asar` calls download and execute the `asar` npm package at build time without a pinned version or integrity check, which is a supply-chain risk (an attacker who compromises the `asar` npm package could execute arbitrary code during the build). However, this is a well-known, widely-used Electron tooling package and the pattern is common in AUR electron repacks. The actual source files come from a GitHub releases page with sha256sums (the DMG and whl are checksummed; the gateway script has SKIP which is mildly concerning but it's a local file). The Python inline scripts perform straightforward text substitution and icon conversion with no obfuscation. The whl file is installed as a data file (not executed at build time). The main concern is the unpinned `npx --yes asar` fetching from npm at build time without a hash, which is a real but moderate supply-chain risk rather than active malware. Overall this is medium risk due to the unpinned remote npm package execution during build, not high.

1 higher static finding superseded - not the current verdict (shown for transparency)

High npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell.

PKGBUILD:69 npx --yes asar extract app.asar "${asar_tmpdir}/app" >/dev/null
PKGBUILD:79 npx --yes asar pack "${asar_tmpdir}/app" app.asar >/dev/null

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=opensquilla
    
      4pkgver=0.5.4
    
      5pkgrel=1
    
      6pkgdesc='OpenSquilla desktop app repackaged from the official macOS release'
    
      7arch=('x86_64')
    
      8url='https://opensquilla.cn/zh/'
    
      9license=('Apache-2.0')
    
      10depends=(
    
      11  'electron42'
    
      12  'hicolor-icon-theme'
    
      13  'xdg-utils'
    
      14)
    
      15makedepends=(
    
      16  '7zip'
    
      17  'python'
    
      18  'python-pillow'
    
      19)
    
      20options=('!strip' '!lto')
    
      21source=(
    
      22  "OpenSquilla-${pkgver}-mac-arm64.dmg::https://github.com/TokenRhythm/opensquilla/releases/download/v${pkgver}/OpenSquilla-${pkgver}-mac-arm64.dmg"
    
      23  "opensquilla-${pkgver}-py3-none-any.whl::https://github.com/TokenRhythm/opensquilla/releases/download/v${pkgver}/opensquilla-${pkgver}-py3-none-any.whl"
    
      24  'opensquilla.sh'
    
      25  'opensquilla-gateway.sh'
    
      26  'opensquilla.desktop'
    
      27)
    
      28noextract=("OpenSquilla-${pkgver}-mac-arm64.dmg")
    
      29sha256sums=(
    
      30  '0be553894467c1887090da965fcceab8a2e908c05fc9b890966d5882de3600d3'
    
      31  '79a8644b6e62d9dbab602684189cff0350c2d6637d0df050d49c9a7a98b8f3f6'
    
      32  'c101ed4bf5ff25352e2fc6136b7c5e4f542ec9c8724354f3afade11bbf6de939'
    
      33  'SKIP'
    
      34  'a5e72781a32dec1ac68ce5ab9d09539c8919d2785667996b8d7ffc2c1c0ad5f3'
    
      35)
    
      36
    
      37prepare() {
    
      38  cd "${srcdir}"
    
      39  rm -rf dmg resources app.asar boot.html runtime app-update.yml opensquilla.png
    
      40  mkdir -p dmg resources
    
      41
    
      42  7z x -bd -y "OpenSquilla-${pkgver}-mac-arm64.dmg" -odmg >/dev/null
    
      43
    
      44  local appdir resources_dir icon_path asar_tmpdir
    
      45  appdir="$(find dmg -maxdepth 4 -type d -name 'OpenSquilla.app' ! -path '*/__MACOSX/*' -print -quit)"
    
      46  [[ -n "${appdir}" ]] || {
    
      47    echo 'Could not find OpenSquilla.app in upstream dmg' >&2
    
      48    return 1
    
      49  }
    
      50
    
      51  resources_dir="${appdir}/Contents/Resources"
    
      52  icon_path="${resources_dir}/icon.icns"
    
      53
    
      54  install -Dm644 "${resources_dir}/app.asar" app.asar
    
      55  install -Dm644 "${resources_dir}/boot.html" boot.html
    
      56
    
      57  if [[ -d "${resources_dir}/runtime" ]]; then
    
      58    cp -a "${resources_dir}/runtime" .
    
      59    find runtime -type f \( -name '.DS_Store' -o -name '._*' -o -name '*:com.apple.*' \) -delete
    
      60  fi
    
      61
    
      62
    
      63  if [[ -f "${resources_dir}/app-update.yml" ]]; then
    
      64    install -Dm644 "${resources_dir}/app-update.yml" app-update.yml
    
      65  fi
    
      66
    
      67  asar_tmpdir="$(mktemp -d)"
    
      68  trap 'rm -rf "${asar_tmpdir}"' RETURN
    
      69  npx --yes asar extract app.asar "${asar_tmpdir}/app" >/dev/null
    
      70  python - "${asar_tmpdir}/app/dist/main.js" <<'PY'
    
      71from pathlib import Path
    
      72import sys
    
      73path = Path(sys.argv[1])
    
      74text = path.read_text()
    
      75text = text.replace('process.resourcesPath', 'dirname(app.getAppPath())')
    
      76text = text.replace('app.isPackaged', 'true')
    
      77path.write_text(text)
    
      78PY
    
      79  npx --yes asar pack "${asar_tmpdir}/app" app.asar >/dev/null
    
      80
    
      81  python - "${icon_path}" <<'PY'
    
      82from pathlib import Path
    
      83from PIL import Image
    
      84import sys
    
      85img = Image.open(Path(sys.argv[1]))
    
      86img.save('opensquilla.png')
    
      87PY
    
      88}
    
      89
    
      90package() {
    
      91  cd "${srcdir}"
    
      92
    
      93  install -dm755 \
    
      94    "${pkgdir}/usr/bin" \
    
      95    "${pkgdir}/usr/lib/${pkgname}/resources" \
    
      96    "${pkgdir}/usr/share/applications" \
    
      97    "${pkgdir}/usr/share/icons/hicolor/512x512/apps"
    
      98
    
      99  install -Dm755 "${srcdir}/opensquilla.sh" \
    
      100    "${pkgdir}/usr/bin/opensquilla"
    
      101  install -Dm644 "${srcdir}/opensquilla.desktop" \
    
      102    "${pkgdir}/usr/share/applications/opensquilla.desktop"
    
      103
    
      104  install -Dm644 app.asar \
    
      105    "${pkgdir}/usr/lib/${pkgname}/resources/app.asar"
    
      106  install -Dm644 boot.html \
    
      107    "${pkgdir}/usr/lib/${pkgname}/resources/boot.html"
    
      108
    
      109  if [[ -d runtime ]]; then
    
      110    cp -a runtime \
    
      111      "${pkgdir}/usr/lib/${pkgname}/resources/"
    
      112    rm -rf "${pkgdir}/usr/lib/${pkgname}/resources/runtime/gateway/opensquilla-gateway"
    
      113  fi
    
      114
    
      115  install -dm755 "${pkgdir}/usr/lib/${pkgname}/resources/runtime/gateway"
    
      116  install -Dm755 "${srcdir}/opensquilla-gateway.sh" \
    
      117    "${pkgdir}/usr/lib/${pkgname}/resources/runtime/gateway/opensquilla-gateway"
    
      118  install -Dm644 "${srcdir}/opensquilla-${pkgver}-py3-none-any.whl" \
    
      119    "${pkgdir}/usr/lib/${pkgname}/resources/runtime/gateway/opensquilla-${pkgver}-py3-none-any.whl"
    
      120
    
      121  if [[ -f app-update.yml ]]; then
    
      122    install -Dm644 app-update.yml \
    
      123      "${pkgdir}/usr/lib/${pkgname}/resources/app-update.yml"
    
      124  fi
    
      125
    
      126  install -Dm644 opensquilla.png \
    
      127    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/opensquilla.png"
    
      128}
    
      129
    
      130

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-05 04:00:58	Medium	3
2026-09-05 03:59:20	High	2