opensquilla

LOW

maintainer duanluan 0 votes scanned 2026-10-20 00:10:31.152894

View on AUR

Why flagged

The two `npx --yes asar` invocations (lines 69 and 79) use the well-known `asar` npm package (the official Electron archive tool) to unpack and repack the app.asar file. `npx --yes` will download the package from the npm registry if not cached, which is a mild supply-chain concern (no pinned version/hash), but `asar` is a widely-used, legitimate tool maintained by the Electron project. The actual code modification performed is minimal and clearly documented: it replaces two string literals in main.js to fix path resolution when running outside a packaged app. The sources are pulled from a GitHub releases page with sha256sums (one SKIP for a shell script is sloppy but not malicious). The Python snippet uses only stdlib+Pillow to convert an icon. No obfuscation, no exfiltration, no encoded payloads. The main concerns are: (1) unpinned `npx asar` download at build time, and (2) repackaging a macOS DMG for Linux use, which is unusual but not inherently malicious. Overall this is a low-quality/sloppy packaging practice rather than a genuine attack.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The two `npx --yes asar` invocations (lines 69 and 79) use the well-known `asar` npm package (the official Electron archive tool) to unpack and repack the app.asar file. `npx --yes` will download the package from the npm registry if not cached, which is a mild supply-chain concern (no pinned version/hash), but `asar` is a widely-used, legitimate tool maintained by the Electron project. The actual code modification performed is minimal and clearly documented: it replaces two string literals in main.js to fix path resolution when running outside a packaged app. The sources are pulled from a GitHub releases page with sha256sums (one SKIP for a shell script is sloppy but not malicious). The Python snippet uses only stdlib+Pillow to convert an icon. No obfuscation, no exfiltration, no encoded payloads. The main concerns are: (1) unpinned `npx asar` download at build time, and (2) repackaging a macOS DMG for Linux use, which is unusual but not inherently malicious. Overall this is a low-quality/sloppy packaging practice rather than a genuine attack.

1 higher static finding superseded - not the current verdict (shown for transparency)

High npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell.

PKGBUILD:69 npx --yes asar extract app.asar "${asar_tmpdir}/app" >/dev/null
PKGBUILD:79 npx --yes asar pack "${asar_tmpdir}/app" app.asar >/dev/null

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=opensquilla
    
      4pkgver=0.5.6
    
      5pkgrel=1
    
      6pkgdesc='OpenSquilla desktop app repackaged from the official macOS release'
    
      7arch=('x86_64')
    
      8url='https://opensquilla.cn/zh/'
    
      9license=('Apache-2.0')
    
      10depends=(
    
      11  'electron42'
    
      12  'hicolor-icon-theme'
    
      13  'xdg-utils'
    
      14)
    
      15makedepends=(
    
      16  '7zip'
    
      17  'python'
    
      18  'python-pillow'
    
      19)
    
      20options=('!strip' '!lto')
    
      21source=(
    
      22  "OpenSquilla-${pkgver}-mac-arm64.dmg::https://github.com/TokenRhythm/opensquilla/releases/download/v${pkgver}/OpenSquilla-${pkgver}-mac-arm64.dmg"
    
      23  "opensquilla-${pkgver}-py3-none-any.whl::https://github.com/TokenRhythm/opensquilla/releases/download/v${pkgver}/opensquilla-${pkgver}-py3-none-any.whl"
    
      24  'opensquilla.sh'
    
      25  'opensquilla-gateway.sh'
    
      26  'opensquilla.desktop'
    
      27)
    
      28noextract=("OpenSquilla-${pkgver}-mac-arm64.dmg")
    
      29sha256sums=(
    
      30  '3e6709b90c0a816949d5d790bb5d88afec21c581856f82bbcca529b458bb4f80'
    
      31  '79a8644b6e62d9dbab602684189cff0350c2d6637d0df050d49c9a7a98b8f3f6'
    
      32  'c101ed4bf5ff25352e2fc6136b7c5e4f542ec9c8724354f3afade11bbf6de939'
    
      33  'SKIP'
    
      34  'a5e72781a32dec1ac68ce5ab9d09539c8919d2785667996b8d7ffc2c1c0ad5f3'
    
      35)
    
      36
    
      37prepare() {
    
      38  cd "${srcdir}"
    
      39  rm -rf dmg resources app.asar boot.html runtime app-update.yml opensquilla.png
    
      40  mkdir -p dmg resources
    
      41
    
      42  7z x -bd -y "OpenSquilla-${pkgver}-mac-arm64.dmg" -odmg >/dev/null
    
      43
    
      44  local appdir resources_dir icon_path asar_tmpdir
    
      45  appdir="$(find dmg -maxdepth 4 -type d -name 'OpenSquilla.app' ! -path '*/__MACOSX/*' -print -quit)"
    
      46  [[ -n "${appdir}" ]] || {
    
      47    echo 'Could not find OpenSquilla.app in upstream dmg' >&2
    
      48    return 1
    
      49  }
    
      50
    
      51  resources_dir="${appdir}/Contents/Resources"
    
      52  icon_path="${resources_dir}/icon.icns"
    
      53
    
      54  install -Dm644 "${resources_dir}/app.asar" app.asar
    
      55  install -Dm644 "${resources_dir}/boot.html" boot.html
    
      56
    
      57  if [[ -d "${resources_dir}/runtime" ]]; then
    
      58    cp -a "${resources_dir}/runtime" .
    
      59    find runtime -type f \( -name '.DS_Store' -o -name '._*' -o -name '*:com.apple.*' \) -delete
    
      60  fi
    
      61
    
      62
    
      63  if [[ -f "${resources_dir}/app-update.yml" ]]; then
    
      64    install -Dm644 "${resources_dir}/app-update.yml" app-update.yml
    
      65  fi
    
      66
    
      67  asar_tmpdir="$(mktemp -d)"
    
      68  trap 'rm -rf "${asar_tmpdir}"' RETURN
    
      69  npx --yes asar extract app.asar "${asar_tmpdir}/app" >/dev/null
    
      70  python - "${asar_tmpdir}/app/dist/main.js" <<'PY'
    
      71from pathlib import Path
    
      72import sys
    
      73path = Path(sys.argv[1])
    
      74text = path.read_text()
    
      75text = text.replace('process.resourcesPath', 'dirname(app.getAppPath())')
    
      76text = text.replace('app.isPackaged', 'true')
    
      77path.write_text(text)
    
      78PY
    
      79  npx --yes asar pack "${asar_tmpdir}/app" app.asar >/dev/null
    
      80
    
      81  python - "${icon_path}" <<'PY'
    
      82from pathlib import Path
    
      83from PIL import Image
    
      84import sys
    
      85img = Image.open(Path(sys.argv[1]))
    
      86img.save('opensquilla.png')
    
      87PY
    
      88}
    
      89
    
      90package() {
    
      91  cd "${srcdir}"
    
      92
    
      93  install -dm755 \
    
      94    "${pkgdir}/usr/bin" \
    
      95    "${pkgdir}/usr/lib/${pkgname}/resources" \
    
      96    "${pkgdir}/usr/share/applications" \
    
      97    "${pkgdir}/usr/share/icons/hicolor/512x512/apps"
    
      98
    
      99  install -Dm755 "${srcdir}/opensquilla.sh" \
    
      100    "${pkgdir}/usr/bin/opensquilla"
    
      101  install -Dm644 "${srcdir}/opensquilla.desktop" \
    
      102    "${pkgdir}/usr/share/applications/opensquilla.desktop"
    
      103
    
      104  install -Dm644 app.asar \
    
      105    "${pkgdir}/usr/lib/${pkgname}/resources/app.asar"
    
      106  install -Dm644 boot.html \
    
      107    "${pkgdir}/usr/lib/${pkgname}/resources/boot.html"
    
      108
    
      109  if [[ -d runtime ]]; then
    
      110    cp -a runtime \
    
      111      "${pkgdir}/usr/lib/${pkgname}/resources/"
    
      112    rm -rf "${pkgdir}/usr/lib/${pkgname}/resources/runtime/gateway/opensquilla-gateway"
    
      113  fi
    
      114
    
      115  install -dm755 "${pkgdir}/usr/lib/${pkgname}/resources/runtime/gateway"
    
      116  install -Dm755 "${srcdir}/opensquilla-gateway.sh" \
    
      117    "${pkgdir}/usr/lib/${pkgname}/resources/runtime/gateway/opensquilla-gateway"
    
      118  install -Dm644 "${srcdir}/opensquilla-${pkgver}-py3-none-any.whl" \
    
      119    "${pkgdir}/usr/lib/${pkgname}/resources/runtime/gateway/opensquilla-${pkgver}-py3-none-any.whl"
    
      120
    
      121  if [[ -f app-update.yml ]]; then
    
      122    install -Dm644 app-update.yml \
    
      123      "${pkgdir}/usr/lib/${pkgname}/resources/app-update.yml"
    
      124  fi
    
      125
    
      126  install -Dm644 opensquilla.png \
    
      127    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/opensquilla.png"
    
      128}
    
      129
    
      130

Changes since previous scan

--- PKGBUILD @ 2026-10-12 00:18
+++ PKGBUILD @ 2026-10-20 00:10
@@ -1,7 +1,7 @@
 # Maintainer: duanluan <duanluan@outlook.com>
 
 pkgname=opensquilla
-pkgver=0.5.5
+pkgver=0.5.6
 pkgrel=1
 pkgdesc='OpenSquilla desktop app repackaged from the official macOS release'
 arch=('x86_64')
@@ -27,7 +27,7 @@
 )
 noextract=("OpenSquilla-${pkgver}-mac-arm64.dmg")
 sha256sums=(
-  '95204d777cf9ca527f5f46dc3a73914dc50b269676c146dabf456adf23a9109b'
+  '3e6709b90c0a816949d5d790bb5d88afec21c581856f82bbcca529b458bb4f80'
   '79a8644b6e62d9dbab602684189cff0350c2d6637d0df050d49c9a7a98b8f3f6'
   'c101ed4bf5ff25352e2fc6136b7c5e4f542ec9c8724354f3afade11bbf6de939'
   'SKIP'

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 01:13:13	Low	2
2026-10-12 01:11:47	High	1
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 23:40:58	High	1
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2