profer-git
LOW
maintainer zxp19821005
0 votes
scanned 2026-11-06 10:14:10.267121
Why flagged
The `bunx electron-builder` call executes a package from the npm registry but electron-builder is a well-known, widely-used build tool for Electron apps; the rest of the build follows standard AUR Electron packaging patterns (building from the project's own git source, using system electron), so there is no clear malicious behaviour, just the inherent supply-chain risk of pulling npm dependencies at build time.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The `bunx electron-builder` call executes a package from the npm registry but electron-builder is a well-known, widely-used build tool for Electron apps; the rest of the build follows standard AUR Electron packaging patterns (building from the project's own git source, using system electron), so there is no clear malicious behaviour, just the inherent supply-chain risk of pulling npm dependencies at build time.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:119
bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=profer-git
3
_pkgname=profer
4
pkgver=0.16.22.r1.g424a9df
5
_electronversion=43
6
_nodeversion=24
7
pkgrel=1
8
pkgdesc="General AI Agent desktop application based on Claude Agent SDK and Pi runtime: multi-model access, collaborative sub-agent, timed task automation, tablet remote access, and team workspace."
9
arch=('any')
10
url="https://profer.cn"
11
_ghurl="https://github.com/Yuan-lai-ru-ci/ProferAI"
12
license=('AGPL-3.0-only')
13
conflicts=("${pkgname%-git}")
14
provides=("${pkgname%-git}=${pkgver%.r*}")
15
depends=(
16
"electron${_electronversion}"
17
'nodejs'
18
'bun'
19
'git'
20
'python'
21
'python-lxml'
22
'python-yaml'
23
'python-pillow'
24
'python-defusedxml'
25
)
26
makedepends=(
27
'npm'
28
'nvm'
29
'gendesk'
30
'jq'
31
)
32
source=(
33
"${pkgname//-/.}::git+${_ghurl}.git"
34
"${pkgname%-git}.js"
35
"${pkgname%-git}.sh"
36
)
37
sha256sums=('SKIP'
38
'562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
39
'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
40
_get_project_dir() {
41
local d
42
while IFS= read -r d; do
43
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
44
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
45
}
46
pkgver() {
47
cd "$(_get_project_dir)"
48
set -o pipefail
49
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
50
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
51
}
52
_ensure_local_nvm() {
53
local NVM_DIR="${srcdir}/.nvm"
54
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
55
nvm install "${_nodeversion}"
56
nvm use "${_nodeversion}"
57
}
58
_get_app_dir() {
59
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
60
| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
61
}
62
_get_electron_version() {
63
local _v=$(find "$(_get_project_dir)" -name package.json ! -path '*/node_modules/*' -exec jq -r '.. | (.electron? // empty) | strings' {} + 2>/dev/null | sed 's/^[^0-9]*//' | grep -E '^[0-9]' | head -1 | sed 's/\..*//')
64
_v=${_v:-$(grep -hoE 'electron[@":][^0-9]*[0-9]+\.[0-9.]+' "$(_get_project_dir)"/*lock* 2>/dev/null | grep -oE '[0-9]+\.[0-9.]+' | head -1 | sed 's/\..*//')}
65
[[ "$_v" =~ ^[0-9] ]] || return 1
66
(( ${_v} == _electronversion )) && echo -e "\033[1;32mElectron version: ${_v}\033[0m" || echo -e "\033[1;31mElectron version: ${_v} (expected ${_electronversion})\033[0m"
67
}
68
_set_electron_build_env() {
69
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
70
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
71
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
72
export ELECTRON_BUILDER_OFFLINE=true
73
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
74
}
75
_set_bun_build_env() {
76
export HOME="${srcdir}/.home"
77
export XDG_CACHE_HOME="${HOME}/.cache"
78
export XDG_CONFIG_HOME="${HOME}/.config"
79
export XDG_DATA_HOME="${HOME}/.local/share"
80
export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
81
export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
82
export BUN_INSTALL_BIN="${HOME}/.bun/bin"
83
export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
84
export BUN_CONFIG_SKIP_LOAD_LOCKFILE=1
85
export BUN_DISABLE_DOTENV=1
86
export DO_NOT_TRACK=1
87
export BUN_JOBS="$(nproc)"
88
mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
89
}
90
prepare() {
91
cd "$(_get_project_dir)"
92
_get_electron_version
93
sed -i -e "
94
s/@electronversion@/${_electronversion}/g
95
s/@appname@/${pkgname%-git}/g
96
" "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
97
gendesk -q -f -n \
98
--pkgname="${pkgname%-git}" \
99
--pkgdesc="${pkgdesc}" \
100
--categories="Development" \
101
--name="${_pkgname}" \
102
--exec="${pkgname%-git} %U"
103
_ensure_local_nvm
104
_set_electron_build_env
105
_set_bun_build_env
106
export NODE_ENV=development
107
bun install
108
cd "$(_get_project_dir)/apps/electron"
109
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
110
}
111
build() {
112
cd "$(_get_project_dir)/apps/electron"
113
_ensure_local_nvm
114
_set_electron_build_env
115
_set_bun_build_env
116
export NODE_ENV=production
117
bun run build
118
bun run sync:runtime-deps
119
bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
120
rm -rf "$(_get_app_dir)/resources/default_app.asar"
121
}
122
package() {
123
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
124
install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
125
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
126
install -Dm644 "$(_get_project_dir)/apps/electron/icon.png" "${pkgdir}/usr/share/icons/hicolor/64x64/apps/${pkgname%-git}.png"
127
install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
128
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
129
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-06 10:14:10 | Low | 3 |
| 2026-11-06 10:12:05 | Medium | 2 |