scalpel-poe
LOW
maintainer scalpelpoe
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The npx command runs electron-builder on the locally built project, not a remote package, so there is no remote code execution risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs electron-builder on the locally built project, not a remote package, so there is no remote code execution risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:61
npx electron-builder --linux AppImage --x64 --publish never
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Scalpel <scalpelpoe at gmail dot com>
2
# Contributor: Kristofers Solo <dev at kristofers dot xyz>
3
4
pkgname=scalpel-poe
5
pkgver=1.0.5
6
pkgrel=1
7
pkgdesc="Path of Exile's First Fourth-Party Tool"
8
arch=("x86_64")
9
url="https://github.com/scalpelpoe/scalpel"
10
license=("AGPL-3.0-only")
11
options=(!strip)
12
depends=(
13
"fuse2"
14
)
15
makedepends=(
16
"git"
17
"nodejs-lts-jod"
18
"npm"
19
"python"
20
"python-setuptools"
21
)
22
provides=("scalpel-poe")
23
conflicts=("scalpel-poe-bin" "scalpel-poe-git")
24
_upstream_version="${pkgver/_/-}"
25
source=(
26
"$pkgname-$_upstream_version.tar.gz::$url/archive/refs/tags/v$_upstream_version.tar.gz"
27
"scalpel-poe.sh"
28
"scalpel-poe.desktop"
29
)
30
sha256sums=('626c11729f2f1bea63ffebeb77be06ddeb7de8bfca989a8203d7ca4185765687'
31
'aec6807cc11a1f0f172577d5d24744d457c2d52fd51c4b92d1e6b8bfbb943b1f'
32
'be4904493f9322e59649768c209eeeed71ebf8f4f92321614967f749807794dc')
33
34
_check_node_version() {
35
local major
36
major="$(node -p 'process.versions.node.split(".")[0]')"
37
38
if [[ "$major" != "22" ]]; then
39
echo "error: Node.js 22 is required, got $(node --version)" >&2
40
exit 1
41
fi
42
}
43
44
_enter_builddir() {
45
cd "$srcdir/scalpel-$_upstream_version" || return 1
46
_check_node_version || return 1
47
48
export SHARP_IGNORE_GLOBAL_LIBVIPS=1
49
}
50
51
prepare() {
52
_enter_builddir
53
54
npm ci --allow-git=root
55
}
56
57
build() {
58
_enter_builddir
59
60
npm run build
61
npx electron-builder --linux AppImage --x64 --publish never
62
}
63
64
package() {
65
cd "$srcdir/scalpel-$_upstream_version"
66
67
install -Dm755 "dist/Scalpel.AppImage" "$pkgdir/opt/scalpel-poe/Scalpel.AppImage"
68
69
install -Dm755 "$srcdir/scalpel-poe.sh" "$pkgdir/usr/bin/scalpel-poe"
70
install -Dm644 "$srcdir/scalpel-poe.desktop" "$pkgdir/usr/share/applications/scalpel-poe.desktop"
71
install -Dm644 resources/icon.png "$pkgdir/usr/share/pixmaps/scalpel-poe.png"
72
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
73
}
74
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |