pear-rec-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-10-30 09:55:25.758986
View on AUR
Why flagged

The PKGBUILD uses 'npx rimraf' and 'npx vite' which execute remote packages from npm; while these are common tools, executing code from a variable or remote source via npx introduces a supply-chain risk if the registry is compromised or spoofed.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:133 npx rimraf dist
  • PKGBUILD:134 npx vite build
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD uses 'npx rimraf' and 'npx vite' which execute remote packages from npm; while these are common tools, executing code from a variable or remote source via npx introduces a supply-chain risk if the registry is compromised or spoofed.

  • PKGBUILD:101 npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

3 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=pear-rec-git
3pkgver=1.3.17.r13.g73df24f
4_electronversion=29
5_nodeversion=20
6_pnpmver=9
7pkgrel=1
8pkgdesc="A free and open-source cross platform software for recording, recording, and taking screenshots."
9arch=(
10 'any'
11)
12url="https://027xiguapi.github.io/pear-rec/"
13_ghurl="https://github.com/027xiguapi/pear-rec"
14license=('Apache-2.0')
15conflicts=("${pkgname%-git}")
16provides=("${pkgname%-git}")
17depends=(
18 "electron${_electronversion}-bin"
19)
20makedepends=(
21 'gendesk'
22 'npm'
23 'nvm'
24 'git'
25 'pnpm'
26 'jq'
27)
28source=(
29 "${pkgname%-git}.git::git+${_ghurl}.git"
30 "${pkgname%-git}.js"
31 "${pkgname%-git}.sh"
32)
33sha256sums=('SKIP'
34 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
35 '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
36_get_project_dir() {
37 local d
38 while IFS= read -r d; do
39 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
40 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
41}
42pkgver() {
43 cd "$(_get_project_dir)"
44 set -o pipefail
45 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
46 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
47}
48_ensure_local_nvm() {
49 local NVM_DIR="${srcdir}/.nvm"
50 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
51 nvm install "${_nodeversion}"
52 nvm use "${_nodeversion}"
53}
54_get_app_dir() {
55 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
56 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
57}
58_get_electron_version() {
59 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
60 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
61 | grep -oE '[0-9]+' | head -1)
62 [[ -z "${_elec_ver}" ]] && return 1
63 (( _elec_ver == _electronversion )) && c=32 || c=31
64 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
65}
66_set_electron_build_env() {
67 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
68 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
69 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
70 export ELECTRON_BUILDER_OFFLINE=true
71 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
72}
73_set_pnpm_build_env() {
74 export HOME="${srcdir}/.home"
75 export XDG_CACHE_HOME="${HOME}/.cache"
76 export XDG_CONFIG_HOME="${HOME}/.config"
77 export XDG_DATA_HOME="${HOME}/.local/share"
78 export XDG_STATE_HOME="${HOME}/.local/state"
79 export PNPM_HOME="${HOME}/.pnpm/bin"
80 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
81 export pnpm_config_store_dir="${HOME}/.pnpm_store"
82 export pnpm_config_global_dir="${HOME}/.pnpm/global"
83 export pnpm_config_state_dir="${HOME}/.pnpm/state"
84 export pnpm_config_node_linker=hoisted
85 export pnpm_config_minimum_release_age=0
86 export pnpm_config_update_notifier=false
87 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
88 export COREPACK_HOME="${HOME}/.corepack"
89 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
90 export PATH="${PNPM_HOME}:${PATH}"
91 local _detected=""
92 local _pkgjson="$(_get_project_dir)/package.json"
93 if [ -f "${_pkgjson}" ]; then
94 _detected="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
95 if [ -z "${_detected}" ]; then
96 _detected="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
97 fi
98 fi
99 local _ver="${_pnpmver:-${_detected}}"
100 if [ -n "${_ver}" ]; then
101 npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \
102 --registry "${COREPACK_NPM_REGISTRY}"
103 fi
104}
105prepare() {
106 cd "$(_get_project_dir)"
107 _get_electron_version
108 sed -i -e "
109 s/@electronversion@/${_electronversion}/g
110 s/@appname@/${pkgname%-git}/g
111 " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
112 gendesk -f -n -q \
113 --pkgname="${pkgname%-git}" \
114 --pkgdesc="${pkgdesc}" \
115 --name="${pkgname%-git}" \
116 --categories="Utility" \
117 --exec="${pkgname} %U"
118 _ensure_local_nvm
119 _set_electron_build_env
120 _set_pnpm_build_env
121 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
122 export NODE_ENV=development
123 pnpm install
124}
125build() {
126 cd "$(_get_project_dir)"
127 _ensure_local_nvm
128 _set_electron_build_env
129 _set_pnpm_build_env
130 export NODE_ENV=production
131 pnpm run -C packages/desktop build
132 cd "$(_get_project_dir)/packages/web"
133 npx rimraf dist
134 npx vite build
135 node "$(_get_project_dir)/tools/copy-files-web2desktop.js"
136 cd "$(_get_project_dir)/packages/desktop"
137 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config=electron-builder.json5"
138 rm -rf "$(_get_app_dir)/resources/default_app.asar"
139}
140package() {
141 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
142 install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
143 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
144 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
145 _icon_sizes=(16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
146 for _icons in "${_icon_sizes[@]}";do
147 install -Dm644 "$(_get_project_dir)/packages/desktop/build/icons/png/${_icons}.png" \
148 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
149 done
150}
151

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-10-30 09:55
@@ -3,8 +3,9 @@
pkgver=1.3.17.r13.g73df24f
_electronversion=29
_nodeversion=20
+_pnpmver=9
pkgrel=1
-pkgdesc="An open-source, cross-platform terminal for seamless workflows.(Use system-wide electron)"
+pkgdesc="A free and open-source cross platform software for recording, recording, and taking screenshots."
arch=(
'any'
)
@@ -14,7 +15,7 @@
conflicts=("${pkgname%-git}")
provides=("${pkgname%-git}")
depends=(
- "electron${_electronversion}"
+ "electron${_electronversion}-bin"
)
makedepends=(
'gendesk'
@@ -22,77 +23,129 @@
'nvm'
'git'
'pnpm'
- 'curl'
+ 'jq'
)
source=(
"${pkgname%-git}.git::git+${_ghurl}.git"
+ "${pkgname%-git}.js"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname%-git}.git"
- set -o pipefail
- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
+}
+_get_app_dir() {
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
+}
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
+}
+_set_electron_build_env() {
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+}
+_set_pnpm_build_env() {
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _detected=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _detected="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_detected}" ]; then
+ _detected="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ local _ver="${_pnpmver:-${_detected}}"
+ if [ -n "${_ver}" ]; then
+ npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
prepare() {
+ cd "$(_get_project_dir)"
+ _get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${pkgname%-git}/g
- s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
- " "${srcdir}/${pkgname%-git}.sh"
+ " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
+ gendesk -f -n -q \
+ --pkgname="${pkgname%-git}" \
+ --pkgdesc="${pkgdesc}" \
+ --name="${pkgname%-git}" \
+ --categories="Utility" \
+ --exec="${pkgname} %U"
_ensure_local_nvm
- gendesk -f -n -q --pkgname="${pkgname%-git}" --pkgdesc="${pkgdesc}" --name="${pkgname%-git}" --categories="Utility" --exec="${pkgname} %U"
- cd "${srcdir}/${pkgname%-git}.git"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- HOME="${srcdir}/.electron-gyp"
- {
- echo -e '\n'
- #echo 'build_from_source=true'
- echo 'link-workspace-packages=true'
- echo 'fetch-retry-maxtimeout=10000'
- echo "cache-dir="${srcdir}"/.pnpm_cache"
- echo "store-dir="${srcdir}"/.pnpm_store"
- echo "shamefully-hoist=true"
- echo "shell-emulator=true"
- echo "virtual-store-dir-max-length=80"
- } >> .npmrc
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- echo 'registry=https://registry.npmmirror.com'
- echo 'disturl=https://registry.npmmirror.com/-/binary/node/'
- echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
- } >> .npmrc
- echo packages/{desktop,docs,recorder,screenshot,server,timer,web} | xargs -n 1 cp .npmrc
- fi
- sed -i "s/\/\${version}//g" -i packages/desktop/electron-builder.json5
- NODE_ENV=development pnpm install
+ _set_electron_build_env
+ _set_pnpm_build_env
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ export NODE_ENV=development
+ pnpm install
}
build() {
- cd "${srcdir}/${pkgname%-git}.git"
- local electronDist="/usr/lib/electron${_electronversion}"
- NODE_ENV=production pnpm run -C packages/desktop build
- NODE_ENV=production pnpm run copy:web
- cd "${srcdir}/${pkgname%-git}.git/packages/desktop"
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${electronDist} --config=electron-builder.json5"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
+ _set_electron_build_env
+ _set_pnpm_build_env
+ export NODE_ENV=production
+ pnpm run -C packages/desktop build
+ cd "$(_get_project_dir)/packages/web"
+ npx rimraf dist
+ npx vite build
+ node "$(_get_project_dir)/tools/copy-files-web2desktop.js"
+ cd "$(_get_project_dir)/packages/desktop"
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config=electron-builder.json5"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/packages/desktop/release/linux-unpacked/resources/app.asar" -t "${pkgdir}/usr/lib/${pkgname}"
- install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
_icon_sizes=(16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
for _icons in "${_icon_sizes[@]}";do
- install -Dm644 "${srcdir}/${pkgname%-git}.git/packages/desktop/build/icons/png/${_icons}.png" \
+ install -Dm644 "$(_get_project_dir)/packages/desktop/build/icons/png/${_icons}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
done
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-10-30 09:55:25 Medium 2
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion