scratch3
LOW
maintainer jasongodev
14 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npm install and npx use official project scripts and dependencies from the source repository; no remote code execution or untrusted external packages are involved.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install and npx use official project scripts and dependencies from the source repository; no remote code execution or untrusted external packages are involved.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:51
npm add -D electron-builder@latest
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:66
npx electron-builder --linux deb --publish=never -c.electronDist=/usr/lib/"$_electron"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Jason Go <jasongo@jasongo.net>
2
# Contributor: Taboon Egon <te451 -_AT_- netcourrier -_DOT_- com>
3
# Contributor: relrel <relrelbachar at gmail dot com>
4
5
pkgname="scratch3"
6
pkgver=3.31.1
7
pkgrel=5
8
pkgdesc='Scratch 3.0 as a self-contained desktop application'
9
arch=('x86_64' 'aarch64')
10
url='https://github.com/scratchfoundation/scratch-desktop'
11
license=('AGPL-3.0-only')
12
_electron='electron39'
13
depends=("$_electron" 'libxcrypt-compat')
14
makedepends=('git' 'nodejs' 'npm')
15
optdepends=('xdg-utils: To open Scratch files from URLs')
16
provides=('scratch3')
17
conflicts=('scratch3-bin' 'scratch-desktop')
18
replaces=('scratch-desktop')
19
options=(!strip !debug)
20
source=(
21
"git+$url.git#tag=v$pkgver"
22
scratch3.{sh.in,xml}
23
)
24
b2sums=('03e7aca64a35417ceecf520d6453428e00bdf0dcfd0816b7f409a8c080034ed288815aec9a27bc1270a251f500dd2ddb3f18b22696b0aaf8e20da2d2348a4f1a'
25
'dbf626b6f14d8053e76b0cc240f26e026105aaab40236be905e1549134ca47b5de47f4866e951db6c3b1b1c67b9fd9ff8c21210be80e52e832ee7e12faa5795e'
26
'd8cc625a9448674762ab94317235a38fa4e7e5581bb058e7d00c8f5ff38eb9ba1bc4260b4a519028f24267ef0cd2e3a312a66acd21c49b8500fe342dd2be733a')
27
28
prepare() {
29
cd scratch-desktop
30
31
# Patch: Set window icon
32
sed -i "s#const window = new BrowserWindow({#const window = new BrowserWindow({ icon: '/usr/share/icons/hicolor/1024x1024/apps/scratch3.png',#g" ./src/main/index.js
33
34
# Make system Electron see the right path for static files
35
sed -i 's|process.resourcesPath + "/static"|"/usr/lib/scratch3/static"|' webpack.makeConfig.js
36
37
# Use scratch3 as name
38
sed -i "s|executableName: scratch-desktop|executableName: scratch3|" electron-builder.yaml
39
40
# Add config for building deb
41
# We prefer to build the deb format so we can have a ready made /usr/share/* much easily
42
cat >> electron-builder.yaml << EOF
43
deb:
44
packageName: scratch3
45
maintainer: "Scratch Foundation <info@scratch.org>"
46
category: "Development;Education;"
47
compression:
48
EOF
49
50
# Update electron-builder to work on latest system nodejs
51
npm add -D electron-builder@latest
52
53
# Use system electron binaries
54
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
55
56
npm install
57
npm run clean
58
npm run fetch
59
}
60
61
build() {
62
cd scratch-desktop
63
64
export NODE_ENV=production
65
npm run compile
66
npx electron-builder --linux deb --publish=never -c.electronDist=/usr/lib/"$_electron"
67
68
# Extract the deb file
69
bsdtar -xf ./dist/scratch*_amd64.deb --include='data.tar*' -O | bsdtar -xf - -C "$srcdir"
70
71
cd "$srcdir"
72
73
# Set the electron binary and fix paths
74
sed -i "s|@ELECTRON@|$_electron|" scratch3.sh.in
75
sed -i 's|/opt/Scratch 3/scratch3|/usr/bin/scratch3|' ./usr/share/applications/scratch3.desktop
76
sed -i 's|/opt/Scratch 3/scratch3|/usr/bin/scratch3|' ./opt/"Scratch 3"/resources/apparmor-profile
77
78
# Add mimetype in .desktop
79
echo "MimeType=x-scratch-project;x.scratch.sb3;x.scratch.sprite3;" >> ./usr/share/applications/scratch3.desktop
80
81
# Not needed
82
rm -f ./opt/"Scratch 3"/resources/{default_app.asar,package-type}
83
}
84
85
package() {
86
# 1. COPY THE BINARIES
87
install -Dm755 scratch3.sh.in "$pkgdir/usr/bin/scratch3"
88
mkdir -p "$pkgdir/usr/lib/scratch3/"
89
cp -dr --no-preserve=ownership ./opt/"Scratch 3"/resources/* "$pkgdir/usr/lib/scratch3/"
90
91
# 2. COPY THE REST OF THE /usr/share/* from deb file
92
mkdir -p "$pkgdir/usr/share"
93
cp -dr --no-preserve=ownership ./usr/share/* "$pkgdir/usr/share"
94
95
# 3. COPY DOCS AND LICENSE
96
install -Dm644 -t "$pkgdir/usr/share/doc/scratch3/" ./scratch-desktop/README.md
97
install -Dm644 -t "$pkgdir/usr/share/licenses/scratch3/" ./scratch-desktop/{LICENSE,TRADEMARK}
98
99
# 4. COPY APPARMOR PROFILE
100
install -dm755 "$pkgdir/etc/apparmor.d/"
101
mv "$pkgdir/usr/lib/scratch3/apparmor-profile" "$pkgdir/etc/apparmor.d/scratch3"
102
103
# 5. COPY MIMETYPE CONFIG
104
install -Dm644 -t "$pkgdir/usr/share/mime/packages/" ./scratch3.xml
105
}
106
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |
| 2026-09-14 00:27:57 | Low | 3 |
| 2026-09-13 00:19:54 | Low | 3 |
| 2026-09-12 00:25:17 | Low | 3 |
| 2026-09-11 00:19:22 | Low | 3 |
| 2026-09-10 00:22:44 | Low | 3 |
| 2026-09-09 00:04:09 | Low | 3 |
| 2026-09-08 00:18:08 | Low | 3 |
| 2026-09-07 00:30:15 | Low | 3 |
| 2026-09-06 00:17:06 | Low | 3 |
| 2026-09-05 00:16:27 | Low | 3 |
| 2026-09-04 00:03:13 | Low | 3 |
| 2026-09-03 00:15:47 | Low | 3 |
| 2026-09-02 00:02:31 | Low | 3 |
| 2026-09-01 00:11:19 | Low | 3 |
| 2026-08-31 00:19:57 | Low | 3 |
| 2026-08-30 00:04:14 | Low | 3 |
| 2026-08-29 00:29:17 | Low | 3 |