postybirb

LOW

maintainer zxp19821005 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The PKGBUILD builds PostyBirb from its official GitHub source tarball (mvdicarlo/postybirb). The flagged patterns are: (1) `npm install -g "@yarnpkg/cli-dist@${_yarnver}"` at line 92 installs a yarn version read from the project's own package.json packageManager field — this is a standard corepack-style pattern for installing the exact yarn version declared by the upstream project, not an attacker-controlled package name; (2) `yarn add --dev node-addon-api` at line 132 installs a well-known, official npm package (node-addon-api by Node.js contributors) needed for native addon builds. Both patterns are common in Electron app AUR PKGBUILDs by this maintainer. The source is fetched from the official GitHub release tag with a declared sha256sum. No obfuscation, no exfiltration, no attacker-controlled hosts, no encoded payloads. The build uses system electron and standard npm/yarn registries (configurable via NPM_CONFIG_REGISTRY). This is a legitimate, if complex, Electron app build pattern and the HIGH flag is a false positive.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The PKGBUILD builds PostyBirb from its official GitHub source tarball (mvdicarlo/postybirb). The flagged patterns are: (1) `npm install -g "@yarnpkg/cli-dist@${_yarnver}"` at line 92 installs a yarn version read from the project's own package.json packageManager field — this is a standard corepack-style pattern for installing the exact yarn version declared by the upstream project, not an attacker-controlled package name; (2) `yarn add --dev node-addon-api` at line 132 installs a well-known, official npm package (node-addon-api by Node.js contributors) needed for native addon builds. Both patterns are common in Electron app AUR PKGBUILDs by this maintainer. The source is fetched from the official GitHub release tag with a declared sha256sum. No obfuscation, no exfiltration, no attacker-controlled hosts, no encoded payloads. The build uses system electron and standard npm/yarn registries (configurable via NPM_CONFIG_REGISTRY). This is a legitimate, if complex, Electron app build pattern and the HIGH flag is a false positive.

PKGBUILD:92 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"

1 higher static finding superseded - not the current verdict (shown for transparency)

High npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time.

PKGBUILD:132 yarn add --dev node-addon-api

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Contributor: Jacqueline Fisher <jcfisher@reality-overwritten.net>
    
      3pkgname=postybirb
    
      4_pkgname=PostyBirb
    
      5pkgver=4.1.2
    
      6_electronversion=42
    
      7_nodeversion=24
    
      8pkgrel=1
    
      9pkgdesc="An application that helps artists post art and other multimedia to multiple websites more quickly."
    
      10arch=('any')
    
      11url="https://www.postybirb.com/"
    
      12_ghurl="https://github.com/mvdicarlo/postybirb"
    
      13license=('BSD-3-Clause')
    
      14provides=("${pkgname}")
    
      15conflicts=(
    
  "${pkgname}"
    
  "${pkgname}-plus"
    
      18)
    
      19depends=(
    
  "electron${_electronversion}"
    
      21)
    
      22makedepends=(
    
  'nvm'
    
  'gendesk'
    
  'git'
    
  'jq'
    
      27)
    
      28source=(
    
  "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${pkgver}.tar.gz"
    
  "${pkgname}.sh"
    
      31)
    
      32sha256sums=('d453e2c96697fe7d2e11e362ed3a70e79b9079273f5da1d2e82b530e05512201'
    
          'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
    
      34_get_project_dir() {
    
local d
    
while IFS= read -r d; do
    
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
    
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
    
      39}
    
      40_ensure_local_nvm() {
    
local NVM_DIR="${srcdir}/.nvm"
    
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
nvm install "${_nodeversion}"
    
nvm use "${_nodeversion}"
    
      45}
    
      46_get_app_dir() {
    
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
    
| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
    
      49}
    
      50_get_electron_version() {
    
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
    
| xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
    
| grep -oE '[0-9]+' | head -1)
    
[[ -z "${_elec_ver}" ]] && return 1
    
(( _elec_ver == _electronversion )) && c=32 || c=31
    
echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
    
      57}
    
      58_set_build_env() {
    
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
    
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
    
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
export ELECTRON_BUILDER_OFFLINE=true
    
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
    
export HOME="${srcdir}/.home"
    
export XDG_CACHE_HOME="${HOME}/.cache"
    
export XDG_CONFIG_HOME="${HOME}/.config"
    
export XDG_DATA_HOME="${HOME}/.local/share"
    
export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
    
export YARN_NETWORK_CONCURRENCY=32
    
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
    
export COREPACK_HOME="${HOME}/.corepack"
    
export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
    
local _yarnver _yarnmajor=0
    
_yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
    
_yarnmajor="${_yarnver%%.*}"
    
_yarnmajor="${_yarnmajor:-0}"
    
if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
    
export XDG_STATE_HOME="${HOME}/.local/state"
    
export YARN_ENABLE_GLOBAL_CACHE=false
    
export YARN_ENABLE_MIRROR=false
    
export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
    
export YARN_NODE_LINKER=node-modules
    
export YARN_NM_MODE=hardlinks-local
    
export YARN_ENABLE_TELEMETRY=false
    
export YARN_ENABLE_SCRIPTS=true
    
export YARN_HTTP_TIMEOUT=600000
    
export YARN_HTTP_RETRY=5
    
export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
    
local _yarnhome="${HOME}/.yarn/install"
    
mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
    
if [[ -n "${_yarnver}" ]]; then
    
	npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
    
	export PATH="${_yarnhome}/bin:${PATH}"
    
fi
    
else
    
export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
    
export YARN_LINK_FOLDER="${HOME}/.yarn/link"
    
export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
    
export YARN_NETWORK_TIMEOUT=600000
    
export YARN_CHILD_CONCURRENCY="$(nproc)"
    
export YARN_FROZEN_LOCKFILE=true
    
export YARN_IGNORE_ENGINES=true
    
export YARN_PRODUCTION=false
    
mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
    
fi
    
local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
    
_reg="${_reg%/}"
    
if [[ -f .yarnrc ]]; then
    
sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
    
fi
    
if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
    
sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
    
fi
    
      114}
    
      115prepare() {
    
  cd "$(_get_project_dir)"
    
  _get_electron_version
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname}/g
    
  " "${srcdir}/${pkgname}.sh"
    
  gendesk -q -f -n \
    
      --pkgname="${pkgname}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="Utility" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname} %U"
    
  _ensure_local_nvm
    
  _set_build_env
    
  jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
    
  export NODE_ENV=development
    
  yarn add --dev node-addon-api
    
  yarn install
    
      134}
    
      135build() {
    
  cd "$(_get_project_dir)"
    
  _ensure_local_nvm
    
  _set_build_env
    
  export NODE_ENV=production
    
  yarn run build:prod
    
  yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
    
rm -rf "$(_get_app_dir)/resources/default_app.asar"
    
      143}
    
      144package() {
    
  install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
    
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
    
  install -Dm644 "$(_get_project_dir)/packaging-resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
  install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      151}

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 23:46:04	High	1
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 07:21:16	Low	2