sho-metrics-source-linux

LOW

maintainer emaspa 0 votes scanned 2026-09-13 19:15:06.142757

View on AUR

Why flagged

The package builds from a source tarball hosted on a personal GitHub fork with few votes and recent upload, but it is a legitimate Node.js project that vendors dependencies normally; no remote code execution or malicious behavior is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a source tarball hosted on a personal GitHub fork with few votes and recent upload, but it is a legitimate Node.js project that vendors dependencies normally; no remote code execution or malicious behavior is present.

PKGBUILD

      1# Maintainer: Emanuele Sparvoli <sparvoli@gmail.com>
    
      2
    
      3pkgname=sho-metrics-source-linux
    
      4_forkver=0.3.0-linux.3
    
      5pkgver=0.3.0.linux.3
    
      6pkgrel=1
    
      7pkgdesc="Linux hardware sensor helper daemon for the Sho Metrics OpenDeck plugin"
    
      8arch=('any')
    
      9url="https://github.com/emaspa/sho-metrics-linux"
    
      10license=('GPL-3.0-only')
    
      11depends=('nodejs>=20')
    
      12makedepends=('npm')
    
      13optdepends=(
    
      14    'lact: NVIDIA GPU sensors (hotspot, VRAM junction, fan, power, clocks)'
    
      15    'mangohud: in-game FPS, 1% lows and frametime'
    
      16)
    
      17install="${pkgname}.install"
    
      18source=("${pkgname}-${_forkver}.tar.gz::${url}/releases/download/v${_forkver}/${pkgname}-${_forkver}.tar.gz")
    
      19# Placeholder: run updpkgsums once the release asset is uploaded, then regenerate
    
      20# .SRCINFO with `makepkg --printsrcinfo > .SRCINFO`.
    
      21sha256sums=('30aeb854a059ba0eb8cd8ec4b0fa86a7d4431822478aab06ceb535131cb5c69d')
    
      22
    
      23_libdir="/usr/lib/${pkgname}"
    
      24
    
      25build() {
    
      26    cd "${pkgname}-${_forkver}"
    
      27
    
      28    # Vendors the dependencies from package-lock.json. Needs network, like every
    
      29    # other AUR node package; the user never runs npm afterwards.
    
      30    export npm_config_cache="${srcdir}/npm-cache"
    
      31    npm ci --omit=dev --ignore-scripts --no-fund --no-audit
    
      32
    
      33    sed -e "s|@NODE@|/usr/bin/node|" \
    
      34        -e "s|@SERVER_PATH@|${_libdir}/server.mjs|" \
    
      35        -e "s|@PROTO_DIR@|${_libdir}/proto|" \
    
      36        systemd/shometrics-linux-helper.service > shometrics-linux-helper.service
    
      37}
    
      38
    
      39check() {
    
      40    cd "${pkgname}-${_forkver}"
    
      41    SHOMETRICS_PROTO_DIR="${PWD}/proto" node server.mjs --check
    
      42}
    
      43
    
      44package() {
    
      45    cd "${pkgname}-${_forkver}"
    
      46
    
      47    install -dm755 "${pkgdir}${_libdir}"
    
      48    cp -a server.mjs package.json proto node_modules "${pkgdir}${_libdir}/"
    
      49
    
      50    install -Dm755 "${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      51    install -Dm644 shometrics-linux-helper.service \
    
      52        "${pkgdir}/usr/lib/systemd/user/shometrics-linux-helper.service"
    
      53    install -Dm644 README.md -t "${pkgdir}/usr/share/doc/${pkgname}/"
    
      54    install -Dm644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-13 19:15:06	Low	2