scratch3

maintainer jasongodev · 14 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npm install and npx use official project scripts and dependencies from the source repository; no remote code execution or untrusted external packages are involved.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install and npx use official project scripts and dependencies from the source repository; no remote code execution or untrusted external packages are involved.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:51 npm add -D electron-builder@latest

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:66 npx electron-builder --linux deb --publish=never -c.electronDist=/usr/lib/"$_electron"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Jason Go <jasongo@jasongo.net>
    
      2# Contributor: Taboon Egon <te451 -_AT_- netcourrier -_DOT_- com>
    
      3# Contributor: relrel <relrelbachar at gmail dot com>
    
      4
    
      5pkgname="scratch3"
    
      6pkgver=3.31.1
    
      7pkgrel=5
    
      8pkgdesc='Scratch 3.0 as a self-contained desktop application'
    
      9arch=('x86_64' 'aarch64')
    
      10url='https://github.com/scratchfoundation/scratch-desktop'
    
      11license=('AGPL-3.0-only')
    
      12_electron='electron39'
    
      13depends=("$_electron" 'libxcrypt-compat')
    
      14makedepends=('git' 'nodejs' 'npm')
    
      15optdepends=('xdg-utils: To open Scratch files from URLs')
    
      16provides=('scratch3')
    
      17conflicts=('scratch3-bin' 'scratch-desktop')
    
      18replaces=('scratch-desktop')
    
      19options=(!strip !debug)
    
      20source=(
    
      21  "git+$url.git#tag=v$pkgver"
    
      22  scratch3.{sh.in,xml}
    
      23)
    
      24b2sums=('03e7aca64a35417ceecf520d6453428e00bdf0dcfd0816b7f409a8c080034ed288815aec9a27bc1270a251f500dd2ddb3f18b22696b0aaf8e20da2d2348a4f1a'
    
      25        'dbf626b6f14d8053e76b0cc240f26e026105aaab40236be905e1549134ca47b5de47f4866e951db6c3b1b1c67b9fd9ff8c21210be80e52e832ee7e12faa5795e'
    
      26        'd8cc625a9448674762ab94317235a38fa4e7e5581bb058e7d00c8f5ff38eb9ba1bc4260b4a519028f24267ef0cd2e3a312a66acd21c49b8500fe342dd2be733a')
    
      27
    
      28prepare() {
    
      29  cd scratch-desktop
    
      30
    
      31  # Patch: Set window icon
    
      32  sed -i "s#const window = new BrowserWindow({#const window = new BrowserWindow({ icon: '/usr/share/icons/hicolor/1024x1024/apps/scratch3.png',#g" ./src/main/index.js
    
      33
    
      34  # Make system Electron see the right path for static files
    
      35  sed -i 's|process.resourcesPath + "/static"|"/usr/lib/scratch3/static"|' webpack.makeConfig.js
    
      36
    
      37  # Use scratch3 as name
    
      38  sed -i "s|executableName: scratch-desktop|executableName: scratch3|" electron-builder.yaml
    
      39
    
      40  # Add config for building deb
    
      41  # We prefer to build the deb format so we can have a ready made /usr/share/* much easily
    
      42  cat >> electron-builder.yaml << EOF
    
      43deb:
    
      44  packageName: scratch3
    
      45  maintainer: "Scratch Foundation <info@scratch.org>"
    
      46  category: "Development;Education;"
    
      47  compression:
    
      48EOF
    
      49
    
      50  # Update electron-builder to work on latest system nodejs
    
      51  npm add -D electron-builder@latest
    
      52
    
      53  # Use system electron binaries
    
      54  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      55
    
      56  npm install
    
      57  npm run clean
    
      58  npm run fetch
    
      59}
    
      60
    
      61build() {
    
      62  cd scratch-desktop
    
      63
    
      64  export NODE_ENV=production
    
      65  npm run compile
    
      66  npx electron-builder --linux deb --publish=never -c.electronDist=/usr/lib/"$_electron"
    
      67  
    
      68  # Extract the deb file
    
      69  bsdtar -xf ./dist/scratch*_amd64.deb --include='data.tar*' -O | bsdtar -xf - -C "$srcdir"
    
      70
    
      71  cd "$srcdir"
    
      72
    
      73  # Set the electron binary and fix paths
    
      74  sed -i "s|@ELECTRON@|$_electron|" scratch3.sh.in
    
      75  sed -i 's|/opt/Scratch 3/scratch3|/usr/bin/scratch3|' ./usr/share/applications/scratch3.desktop
    
      76  sed -i 's|/opt/Scratch 3/scratch3|/usr/bin/scratch3|' ./opt/"Scratch 3"/resources/apparmor-profile
    
      77
    
      78  # Add mimetype in .desktop
    
      79  echo "MimeType=x-scratch-project;x.scratch.sb3;x.scratch.sprite3;" >> ./usr/share/applications/scratch3.desktop
    
      80
    
      81  # Not needed
    
      82  rm -f ./opt/"Scratch 3"/resources/{default_app.asar,package-type}
    
      83}
    
      84
    
      85package() {
    
      86  # 1. COPY THE BINARIES
    
      87  install -Dm755 scratch3.sh.in "$pkgdir/usr/bin/scratch3"
    
      88  mkdir -p "$pkgdir/usr/lib/scratch3/"
    
      89  cp -dr --no-preserve=ownership ./opt/"Scratch 3"/resources/* "$pkgdir/usr/lib/scratch3/"
    
      90  
    
      91  # 2. COPY THE REST OF THE /usr/share/* from deb file
    
      92  mkdir -p "$pkgdir/usr/share"
    
      93  cp -dr --no-preserve=ownership ./usr/share/* "$pkgdir/usr/share"
    
      94
    
      95  # 3. COPY DOCS AND LICENSE
    
      96  install -Dm644 -t "$pkgdir/usr/share/doc/scratch3/" ./scratch-desktop/README.md
    
      97  install -Dm644 -t "$pkgdir/usr/share/licenses/scratch3/" ./scratch-desktop/{LICENSE,TRADEMARK}
    
      98
    
      99  # 4. COPY APPARMOR PROFILE
    
      100  install -dm755 "$pkgdir/etc/apparmor.d/"
    
      101  mv "$pkgdir/usr/lib/scratch3/apparmor-profile" "$pkgdir/etc/apparmor.d/scratch3"
    
      102
    
      103  # 5. COPY MIMETYPE CONFIG
    
      104  install -Dm644 -t "$pkgdir/usr/share/mime/packages/" ./scratch3.xml
    
      105}
    
      106

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3