peersky-browser

LOW
maintainer zxp19821005 0 votes scanned 2026-10-07 06:05:09.924014
View on AUR
Why flagged

The package builds from a legitimate project source on GitHub, uses standard Node.js and pnpm workflows, and installs pnpm dynamically based on version in package.json; while the dynamic package manager install is flagged, it is derived from the project's own manifest and not an external untrusted source, posing minimal risk.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a legitimate project source on GitHub, uses standard Node.js and pnpm workflows, and installs pnpm dynamically based on version in package.json; while the dynamic package manager install is flagged, it is derived from the project's own manifest and not an external untrusted source, posing minimal risk.

  • PKGBUILD:82 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=peersky-browser
3_pkgname='Peersky Browser'
4pkgver=1.0.0_beta.29
5_electronversion=43
6_nodeversion=24
7pkgrel=1
8pkgdesc="A minimal local-first p2p web browser: access, communicate, and publish offline."
9arch=("any")
10url="https://peersky.p2plabs.xyz/"
11_ghurl="https://github.com/p2plabsxyz/peersky-browser"
12license=('MIT')
13conflicts=("${pkgname}")
14depends=(
15 "electron${_electronversion}"
16)
17makedepends=(
18 'npm'
19 'pnpm'
20 'gendesk'
21 'nvm'
22 'git'
23 'jq'
24)
25source=(
26 "${pkgname}-${pkgver}::git+${_ghurl}/#tag=v${pkgver//_/-}"
27 "${pkgname}.sh"
28)
29options=(
30 '!emptydirs'
31 '!strip'
32)
33sha256sums=('d045c52fed3db5b9725e708f325199366429d1aa48d9397a97b2fc253f7cbb70'
34 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
35_ensure_local_nvm() {
36 local NVM_DIR="${srcdir}/.nvm"
37 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
38 nvm install "${_nodeversion}"
39 nvm use "${_nodeversion}"
40}
41_get_project_dir() {
42 local d
43 while IFS= read -r d; do
44 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
45 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
46}
47_get_app_dir() {
48 find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
49}
50_set_build_env() {
51 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
52 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
53 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
54 export ELECTRON_BUILDER_OFFLINE=true
55 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
56 export HOME="${srcdir}/.home"
57 export XDG_CACHE_HOME="${HOME}/.cache"
58 export XDG_CONFIG_HOME="${HOME}/.config"
59 export XDG_DATA_HOME="${HOME}/.local/share"
60 export XDG_STATE_HOME="${HOME}/.local/state"
61 export PNPM_HOME="${HOME}/.pnpm/bin"
62 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
63 export pnpm_config_store_dir="${HOME}/.pnpm_store"
64 export pnpm_config_global_dir="${HOME}/.pnpm/global"
65 export pnpm_config_state_dir="${HOME}/.pnpm/state"
66 export pnpm_config_node_linker=hoisted
67 export pnpm_config_minimum_release_age=0
68 export pnpm_config_update_notifier=false
69 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
70 export COREPACK_HOME="${HOME}/.corepack"
71 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
72 export PATH="${PNPM_HOME}:${PATH}"
73 local _pnpmver=""
74 local _pkgjson="$(_get_project_dir)/package.json"
75 if [ -f "${_pkgjson}" ]; then
76 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
77 if [ -z "${_pnpmver}" ]; then
78 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
79 fi
80 fi
81 if [ -n "${_pnpmver}" ]; then
82 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
83 --registry "${COREPACK_NPM_REGISTRY}"
84 fi
85}
86_get_electron_version() {
87 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
88 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
89 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
90 [[ -z "${_elec_ver}" ]] && return 1
91 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
92}
93prepare() {
94 cd "$(_get_project_dir)"
95 _get_electron_version
96 sed -i -e "
97 s/@electronversion@/${_electronversion}/g
98 s/@appname@/${pkgname}/g
99 s/@runname@/app.asar/g
100 s/@cfgdirname@/${pkgname}/g
101 " "${srcdir}/${pkgname}.sh"
102 gendesk -f -n -q \
103 --pkgname="${pkgname}" \
104 --pkgdesc="${pkgdesc}" \
105 --categories="Network" \
106 --name="${_pkgname}" \
107 -exec="${pkgname} %U"
108 _ensure_local_nvm
109 _set_build_env
110 sed -i "/openDevTools/d" src/main.js
111 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
112 export NODE_ENV=development
113 pnpm install --no-lockfile
114}
115build() {
116 cd "$(_get_project_dir)"
117 _ensure_local_nvm
118 _set_build_env
119 export NODE_ENV=production
120 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
121 local _app_dir="$(_get_app_dir)"
122 case "${CARCH}" in
123 aarch64) _archrem=x64 ;;
124 x86_64) _archrem=arm ;;
125 esac
126 find "${_app_dir}/resources/app.asar.unpacked" -type d \
127 \( -name "darwin*" -o -name "win32*" -o -name "*${_archrem}"* \) \
128 -exec rm -rf {} +
129}
130package() {
131 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
132 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
133 local _app_dir="$(_get_app_dir)"
134 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
135 local _src="$(_get_project_dir)"
136 install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
137 install -Dm644 "${_src}/public/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
138 install -Dm644 "${_src}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
139}

Changes since previous scan

--- PKGBUILD @ 2026-07-07 01:22
+++ PKGBUILD @ 2026-10-07 06:05
@@ -1,11 +1,11 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=peersky-browser
_pkgname='Peersky Browser'
-pkgver=1.0.0_beta.27
-_electronversion=41
+pkgver=1.0.0_beta.29
+_electronversion=43
_nodeversion=24
pkgrel=1
-pkgdesc="A minimal local-first p2p web browser: access, communicate, and publish offline.(Use system-wide electron)"
+pkgdesc="A minimal local-first p2p web browser: access, communicate, and publish offline."
arch=("any")
url="https://peersky.p2plabs.xyz/"
_ghurl="https://github.com/p2plabsxyz/peersky-browser"
@@ -19,60 +19,79 @@
'pnpm'
'gendesk'
'nvm'
- 'curl'
'git'
'jq'
)
-options=('!strip')
source=(
"${pkgname}-${pkgver}::git+${_ghurl}/#tag=v${pkgver//_/-}"
"${pkgname}.sh"
)
-sha256sums=('a2229f619adfdb4a30d4f15b3e5dd95fd5e3575275b0809793faa0120a8c4933'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+options=(
+ '!emptydirs'
+ '!strip'
+)
+sha256sums=('d045c52fed3db5b9725e708f325199366429d1aa48d9397a97b2fc253f7cbb70'
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
}
_set_build_env() {
- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- export HOME="${srcdir}/.electron-gyp"
- {
- export PNPM_LINK_WORKSPACE_PACKAGES=true
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_SHAMEFULLY_HOIST=true
- export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
- export PNPM_NODE_LINKER=hoisted
- export PNPM_NETWORK_CONCURRENCY=32
- }
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export pnpm_config_registry="https://registry.npmmirror.com"
- export npm_config_registry="https://registry.npmmirror.com"
- export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
- export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- }
- fi
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
@@ -86,29 +105,35 @@
--categories="Network" \
--name="${_pkgname}" \
-exec="${pkgname} %U"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
sed -i "/openDevTools/d" src/main.js
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development pnpm install --no-lockfile
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ export NODE_ENV=development
+ pnpm install --no-lockfile
}
build() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
- local _app_dir=$(_get_app_dir)
- find "${_app_dir}/resources/app.asar.unpacked" -type d \
- \( -name "android-*" -o -name "linux-arm*" -o -name "darwin-*" -o -name "win32-*" -o -name "ios-*" \) \
- -exec rm -rf {} +
+ export NODE_ENV=production
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
+ local _app_dir="$(_get_app_dir)"
+ case "${CARCH}" in
+ aarch64) _archrem=x64 ;;
+ x86_64) _archrem=arm ;;
+ esac
+ find "${_app_dir}/resources/app.asar.unpacked" -type d \
+ \( -name "darwin*" -o -name "win32*" -o -name "*${_archrem}"* \) \
+ -exec rm -rf {} +
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname}/"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/public/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ local _app_dir="$(_get_app_dir)"
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
+ local _src="$(_get_project_dir)"
+ install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${_src}/public/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
+ install -Dm644 "${_src}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
}
-

Scan history

Scanned at (UTC)SeverityRules
2026-10-07 06:05:09 Low 1
2026-07-07 01:22:52 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion