overlayed-git

maintainer SelfRef · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged This is a standard Tauri/Node.js application build from a known open-source GitHub repository (overlayeddev/overlayed). The flagged patterns are common in AUR packages for Node.js-based apps: (1) nvm is used to install a specific Node.js version in an isolated srcdir, which is a well-known AUR pattern; (2) `npm install -g` installs the package manager specified in the project's own package.json (the `packageManager` field, typically something like `pnpm@x.y.z`), not an attacker-controlled string — this is the standard corepack/packageManager convention; (3) `pnpm install` fetches npm dependencies declared in the project's package.json/pnpm-lock.yaml from the upstream source. The absence of a lockfile check is a supply-chain hygiene concern (low severity) but not malware. There is no obfuscation, no encoded payload, no exfiltration, no substitution of upstream sources, and no piracy. The source is fetched directly from the official GitHub repo with git. The cheaper model's HIGH rating is a false positive based on misunderstanding normal Node.js build patterns.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): This is a standard Tauri/Node.js application build from a known open-source GitHub repository (overlayeddev/overlayed). The flagged patterns are common in AUR packages for Node.js-based apps: (1) nvm is used to install a specific Node.js version in an isolated srcdir, which is a well-known AUR pattern; (2) `npm install -g` installs the package manager specified in the project's own package.json (the `packageManager` field, typically something like `pnpm@x.y.z`), not an attacker-controlled string — this is the standard corepack/packageManager convention; (3) `pnpm install` fetches npm dependencies declared in the project's package.json/pnpm-lock.yaml from the upstream source. The absence of a lockfile check is a supply-chain hygiene concern (low severity) but not malware. There is no obfuscation, no encoded payload, no exfiltration, no substitution of upstream sources, and no piracy. The source is fetched directly from the official GitHub repo with git. The cheaper model's HIGH rating is a false positive based on misunderstanding normal Node.js build patterns.

PKGBUILD:42 npm install -g "$(node -p 'require("./package.json").packageManager')"

1 higher static finding superseded - not the current verdict (shown for transparency)

HIGH npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time.

PKGBUILD:42 npm install -g "$(node -p 'require("./package.json").packageManager')"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: SelfRef <arch@selfref.dev>
    
      2
    
      3_basename=overlayed
    
      4pkgname=${_basename}-git
    
      5pkgver=r1053.d2e86f0
    
      6pkgrel=1
    
      7pkgdesc="A modern, open-source, and free voice chat overlay for Discord (git version)"
    
      8arch=('x86_64')
    
      9url="https://overlayed.dev"
    
      10license=('AGPL-3.0')
    
      11depends=('webkit2gtk-4.1' 'libayatana-appindicator' 'openssl' 'librsvg')
    
      12makedepends=('git' 'nvm' 'cargo')
    
      13optdepends=('discord: Needed for overlay to work')
    
      14provides=("$_basename")
    
      15conflicts=("$_basename")
    
      16source=(
    
      17	"$_basename::git+https://github.com/overlayeddev/overlayed.git"
    
      18	'overlayed.desktop'
    
      19)
    
      20sha256sums=('SKIP'
    
      21            '30ad415ebf2124f6fe4697ba915194c0aa76002aa70b17ecfeac966b158a5f33')
    
      22
    
      23pkgver() {
    
      24	cd "$_basename"
    
      25	( set -o pipefail
    
      26		git describe --long --abbrev=7 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      27		printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      28	)
    
      29}
    
      30
    
      31_ensure_local_nvm() {
    
      32	which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      33	export NVM_DIR="${srcdir}/.nvm"
    
      34	source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      35}
    
      36
    
      37prepare() {
    
      38	cd $_basename
    
      39
    
      40	_ensure_local_nvm
    
      41	nvm install 20
    
      42	npm install -g "$(node -p 'require("./package.json").packageManager')"
    
      43
    
      44	cd apps/desktop
    
      45	pnpm install
    
      46}
    
      47
    
      48build() {
    
      49	cd $_basename/apps/desktop
    
      50
    
      51	_ensure_local_nvm
    
      52	export TURBO_UI=0
    
      53	export CFLAGS="$CFLAGS -ffat-lto-objects" # prevent linker error
    
      54	export TAURI_APP_PATH="$PWD/src-tauri"
    
      55
    
      56	pnpm build:desktop --no-bundle
    
      57}
    
      58
    
      59package() {
    
      60	install -Dm644 ../overlayed.desktop $pkgdir/usr/share/applications/overlayed.desktop
    
      61
    
      62	cd $_basename
    
      63	install -Dm755 apps/desktop/src-tauri/target/release/overlayed $pkgdir/usr/bin/overlayed
    
      64	install -Dm644 apps/desktop/src-tauri/icons/stable/32x32.png $pkgdir/usr/share/icons/hicolor/32x32/apps/overlayed.png
    
      65	install -Dm644 apps/desktop/src-tauri/icons/stable/128x128.png $pkgdir/usr/share/icons/hicolor/128x128/apps/overlayed.png
    
      66	install -Dm644 apps/desktop/src-tauri/icons/stable/128x128@2x.png $pkgdir/usr/share/icons/hicolor/256x256@2/apps/overlayed.png
    
      67}
    
      68

Changes since previous scan

--- PKGBUILD @ 2026-06-19 22:34
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,14 +2,14 @@
 
 _basename=overlayed
 pkgname=${_basename}-git
-pkgver=r1014.4e92603
+pkgver=r1053.d2e86f0
 pkgrel=1
 pkgdesc="A modern, open-source, and free voice chat overlay for Discord (git version)"
 arch=('x86_64')
 url="https://overlayed.dev"
 license=('AGPL-3.0')
 depends=('webkit2gtk-4.1' 'libayatana-appindicator' 'openssl' 'librsvg')
-makedepends=('git' 'pnpm' 'nvm' 'cargo')
+makedepends=('git' 'nvm' 'cargo')
 optdepends=('discord: Needed for overlay to work')
 provides=("$_basename")
 conflicts=("$_basename")
@@ -35,10 +35,13 @@
 }
 
 prepare() {
-	cd $_basename/apps/desktop
+	cd $_basename
 
 	_ensure_local_nvm
 	nvm install 20
+	npm install -g "$(node -p 'require("./package.json").packageManager')"
+
+	cd apps/desktop
 	pnpm install
 }
 
@@ -48,6 +51,7 @@
 	_ensure_local_nvm
 	export TURBO_UI=0
 	export CFLAGS="$CFLAGS -ffat-lto-objects" # prevent linker error
+	export TAURI_APP_PATH="$PWD/src-tauri"
 
 	pnpm build:desktop --no-bundle
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 09:36:59	LOW	2
2026-07-27 09:34:56	HIGH	2
2026-06-19 22:34:54	CLEAN	0