own3d-desktop-git

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The `yarn add -D @electron-forge/plugin-local-electron` installs a package from the official npm registry (npmjs.com). `@electron-forge/plugin-local-electron` is a legitimate, well-known package that is part of the official Electron Forge project (published by the Electron Forge team under the `@electron-forge` scoped namespace). It is used here for a standard purpose: pointing the build system at the system-installed Electron binary instead of downloading one. This is a common AUR pattern for packaging Electron apps against system Electron. The package is not from an unofficial or personal host, and it is not obfuscated or suspicious. The only real concern is that it is not pinned to a specific version, meaning a future malicious publish could affect builds — but this is a standard supply-chain hygiene issue (low severity), not an active threat. The rest of the PKGBUILD sources from the official GitHub repo with a git clone, uses nvm locally, and installs to standard paths. No binaries are fetched from unofficial hosts, no obfuscation is present, and no piracy or breakage is evident.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The `yarn add -D @electron-forge/plugin-local-electron` installs a package from the official npm registry (npmjs.com). `@electron-forge/plugin-local-electron` is a legitimate, well-known package that is part of the official Electron Forge project (published by the Electron Forge team under the `@electron-forge` scoped namespace). It is used here for a standard purpose: pointing the build system at the system-installed Electron binary instead of downloading one. This is a common AUR pattern for packaging Electron apps against system Electron. The package is not from an unofficial or personal host, and it is not obfuscated or suspicious. The only real concern is that it is not pinned to a specific version, meaning a future malicious publish could affect builds — but this is a standard supply-chain hygiene issue (low severity), not an active threat. The rest of the PKGBUILD sources from the official GitHub repo with a git clone, uses nvm locally, and installs to standard paths. No binaries are fetched from unofficial hosts, no obfuscation is present, and no piracy or breakage is evident.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:83 NODE_ENV=development yarn add -D @electron-forge/plugin-local-electron

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=own3d-desktop-git
    
      3_pkgname='OWN3D Pro Desktop'
    
      4pkgver=2.6.0.r0.g18b92c9
    
      5_electronversion=29
    
      6_nodeversion=20
    
      7pkgrel=1
    
      8pkgdesc="Public Development Preview of the OWN3D Desktop App.(Use system-wide electron)"
    
      9arch=('any')
    
      10url="https://www.own3d.pro/"
    
      11_ghurl="https://github.com/own3d/desktop"
    
      12license=("MIT")
    
      13conflicts=("${pkgname%-git}")
    
      14provides=("${pkgname%-git}=${pkgver%.r*}")
    
      15depends=(
    
      16    "electron${_electronversion}"
    
      17)
    
      18makedepends=(
    
      19    'npm'
    
      20    'git'
    
      21    'nvm'
    
      22    'gendesk'
    
      23    'curl'
    
      24    'yarn'
    
      25)
    
      26source=(
    
      27    "${pkgname%-git}.git::git+${_ghurl}.git"
    
      28    "${pkgname%-git}.sh"
    
      29)
    
      30sha256sums=('SKIP'
    
      31            'f2fe8c189974ffb9d445e9a42bd4f1d5b60185607c3fcafae79ab44be224e013')
    
      32pkgver() {
    
      33    cd "${srcdir}/${pkgname%-git}.git"
    
      34    set -o pipefail
    
      35    git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
      36    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      37}
    
      38_ensure_local_nvm() {
    
      39    local NVM_DIR="${srcdir}/.nvm"
    
      40    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      41    nvm install "${_nodeversion}"
    
      42    nvm use "${_nodeversion}"
    
      43}
    
      44prepare() {
    
      45    cd "${srcdir}/${pkgname%-git}.git"
    
      46    sed -i -e "
    
      47        s/@electronversion@/${_electronversion}/g
    
      48        s/@appname@/${pkgname%-git}/g
    
      49        s/@runname@/app.asar/g
    
      50        s/@cfgdirname@/${_pkgname}/g
    
      51        s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
    
      52    " "${srcdir}/${pkgname%-git}.sh"
    
      53    _ensure_local_nvm
    
      54    gendesk -q -f -n \
    
      55        --pkgname="${pkgname%-git}" \
    
      56        --pkgdesc="${pkgdesc}" \
    
      57        --categories="Game" \
    
      58        --name="${_pkgname}" \
    
      59        --exec="${pkgname%-git} %U"
    
      60    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      61    export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
      62    HOME="${srcdir}/.electron-gyp"
    
      63    mkdir -p "${srcdir}/.electron-gyp"
    
      64    if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      65        {
    
      66            echo -e '\n'
    
      67            echo 'registry "https://registry.npmmirror.com"'
    
      68            echo 'electron_mirror "https://registry.npmmirror.com/-/binary/electron/"'
    
      69            echo 'electron_builder_binaries_mirror "https://registry.npmmirror.com/-/binary/electron-builder-binaries/"'
    
      70            echo "cacheFolder "${srcdir}"/.yarn/cache"
    
      71            echo "pluginsFolder "${srcdir}"/.yarn/plugins"
    
      72            echo "globalFolder "${srcdir}"/.yarn/global"
    
      73            echo 'useHardlinks true'
    
      74            #echo 'buildFromSource true'
    
      75            echo 'linkWorkspacePackages true'
    
      76            echo 'fetchRetries 3'
    
      77            echo 'fetchRetryTimeout 10000'
    
      78        } >> .yarnrc
    
      79        find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g" {} +
    
      80    fi
    
      81    sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
      82    NODE_ENV=development    yarn install --cache-folder "${srcdir}/.yarn_cache"
    
      83    NODE_ENV=development    yarn add -D @electron-forge/plugin-local-electron
    
      84}
    
      85build() {
    
      86    cd "${srcdir}/${pkgname%-git}.git"
    
      87    local electronDist="/usr/lib/electron${_electronversion}"
    
      88    sed -i -e "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
    
      89    {\\
    
      90        name: \"@electron-forge/plugin-local-electron\",\\
    
      91        config: {\\
    
      92            electronPath: \"${electronDist}\"\\
    
      93        }\\
    
      94    }," forge.config.*
    
      95    NODE_ENV=production     yarn run package
    
      96}
    
      97package() {
    
      98    install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
      99    install -Dm644 "${srcdir}/${pkgname%-git}.git/out/prod/${_pkgname}-linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"
    
      100    install -Dm644 "${srcdir}/${pkgname%-git}.git/images/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
    
      101    install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
      102    install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      103}
    
      104

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2