simpleshell-git
LOW
maintainer zxp19821005
0 votes
scanned 2026-10-24 00:14:55.209548
Why flagged
The npx command runs electron-forge package, which is a standard build tool for Electron apps, and operates only on the locally checked-out project source; no untrusted remote code is executed.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx command runs electron-forge package, which is a standard build tool for Electron apps, and operates only on the locally checked-out project source; no untrusted remote code is executed.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:126
npx electron-forge package
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=simpleshell-git
3
_pkgname=SimpleShell
4
pkgver=0.5.4.r0.g981e310
5
_electronversion=40
6
_nodeversion=22
7
pkgrel=1
8
pkgdesc="A modern, feature-rich SSH terminal application that combines the power of Electron's desktop capabilities with React's intuitive development experience. Designed for developers and system administrators who need efficient remote server management."
9
arch=('any')
10
url="https://github.com/funkpopo/simpleshell"
11
license=('Apache-2.0')
12
provides=("${pkgname%-git}=${pkgver%.r*}")
13
conflicts=("${pkgname%-git}")
14
depends=(
15
"electron${_electronversion}"
16
)
17
makedepends=(
18
'nvm'
19
'git'
20
'gendesk'
21
'npm'
22
'jq'
23
'zip'
24
'rustup'
25
)
26
source=(
27
"${pkgname//-/.}::git+${url}.git"
28
"${pkgname%-git}.sh"
29
)
30
sha256sums=('SKIP'
31
'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
32
_get_project_dir() {
33
local d
34
while IFS= read -r d; do
35
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
36
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
37
}
38
pkgver() {
39
cd "$(_get_project_dir)"
40
set -o pipefail
41
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
42
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
43
}
44
_ensure_local_nvm() {
45
local NVM_DIR="${srcdir}/.nvm"
46
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
47
nvm install "${_nodeversion}"
48
nvm use "${_nodeversion}"
49
}
50
_get_app_dir() {
51
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
52
| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
53
}
54
_get_electron_version() {
55
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
56
| xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
57
| grep -oE '[0-9]+' | head -1)
58
[[ -z "${_elec_ver}" ]] && return 1
59
(( _elec_ver == _electronversion )) && c=32 || c=31
60
echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
61
}
62
_set_build_env() {
63
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
64
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
65
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
66
export ELECTRON_BUILDER_OFFLINE=true
67
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
68
export HOME="${srcdir}/.home"
69
export XDG_CACHE_HOME="${HOME}/.cache"
70
export XDG_CONFIG_HOME="${HOME}/.config"
71
export XDG_DATA_HOME="${HOME}/.local/share"
72
export npm_config_cache="${HOME}/.npm_cache"
73
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
74
export COREPACK_HOME="${HOME}/.corepack"
75
export npm_config_audit=false
76
export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
77
export CARGO_HOME="${HOME}/.cargo"
78
export CARGO_NET_GIT_FETCH_WITH_CLI=true
79
export CARGO_NET_RETRY=5
80
export CARGO_HTTP_MULTIPLEXING=false
81
export CARGO_INCREMENTAL=0
82
export CARGO_TERM_COLOR=never
83
export CARGO_PROFILE_RELEASE_STRIP=symbols
84
mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}" "${CARGO_HOME}"
85
}
86
_use_local_electron_for_forge() {
87
local _arch=$([[ "${CARCH}" == "aarch64" ]] && echo arm64 || [[ "${CARCH}" == "armv7h" ]] && echo armv7l || echo x64)
88
local _zd="${srcdir}/electron-zips"
89
local _zf="${_zd}/electron-v${SYSTEM_ELECTRON_VERSION}-linux-${_arch}.zip"
90
mkdir -p "${_zd}"
91
rm -f "${_zf}"
92
( cd "${ELECTRON_DIST}" && find . $ -type f -o -type l $ -readable -print | zip -@ -0 -q -y "${_zf}" )
93
[[ -s "${_zf}" ]] || { echo "ERROR: Failed to generate electron zip (directory not readable?)"; return 1; }
94
find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do
95
sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}"
96
done
97
}
98
prepare() {
99
cd "$(_get_project_dir)"
100
_get_electron_version
101
sed -i -e "
102
s/@electronversion@/${_electronversion}/g
103
s/@appname@/${pkgname%-git}/g
104
" "${srcdir}/${pkgname%-git}.sh"
105
gendesk -q -f -n \
106
--pkgname="${pkgname%-git}" \
107
--pkgdesc="${pkgdesc}" \
108
--categories="Utility" \
109
--name="${_pkgname}" \
110
--exec="${pkgname%-git} %U"
111
_ensure_local_nvm
112
_set_build_env
113
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
114
rustup update stable
115
rustup default stable
116
export NODE_ENV=development
117
npm install
118
_use_local_electron_for_forge
119
}
120
build() {
121
cd "$(_get_project_dir)"
122
_ensure_local_nvm
123
_set_build_env
124
export NODE_ENV=production
125
npm run prepare:native-services
126
npx electron-forge package
127
}
128
package() {
129
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
130
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
131
rm -rf "$(_get_app_dir)/resources/default_app.asar"
132
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
133
install -Dm644 "$(_get_project_dir)/src/renderer/assets/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
134
install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
135
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
136
}
137
Changes since previous scan
--- PKGBUILD @ 2026-10-14 00:06+++ PKGBUILD @ 2026-10-24 00:14@@ -1,7 +1,7 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> pkgname=simpleshell-git _pkgname=SimpleShell-pkgver=0.5.3.r1.g6f5e160+pkgver=0.5.4.r0.g981e310 _electronversion=40 _nodeversion=22 pkgrel=1@@ -28,7 +28,7 @@ "${pkgname%-git}.sh" ) sha256sums=('SKIP'- 'cebedc3391cbab6d43f37fbf3a87ddaad16597cb5ea487a4d55b1f478d810082')+ 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8') _get_project_dir() { local d while IFS= read -r d; do@@ -48,7 +48,16 @@ nvm use "${_nodeversion}" } _get_app_dir() {- find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done+}+_get_electron_version() {+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \+ | grep -oE '[0-9]+' | head -1)+ [[ -z "${_elec_ver}" ]] && return 1+ (( _elec_ver == _electronversion )) && c=32 || c=31+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m" } _set_build_env() { export ELECTRON_DIST="/usr/lib/electron${_electronversion}"@@ -74,24 +83,14 @@ export CARGO_PROFILE_RELEASE_STRIP=symbols mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}" "${CARGO_HOME}" }-_get_electron_version() {- _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \- | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \- | grep -oE '[0-9]+' | head -1)- [[ -z "${_elec_ver}" ]] && return 1- (( _elec_ver == _electronversion )) && c=32 || c=31- echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"-} _use_local_electron_for_forge() {- local _v="${SYSTEM_ELECTRON_VERSION}"+ local _arch=$([[ "${CARCH}" == "aarch64" ]] && echo arm64 || [[ "${CARCH}" == "armv7h" ]] && echo armv7l || echo x64) local _zd="${srcdir}/electron-zips"- case "${CARCH}" in- aarch64) _arch=arm64 ;;- x86_64) _arch=x64 ;;- esac- local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"- install -Dm755 -d "${_zd}"- ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )+ local _zf="${_zd}/electron-v${SYSTEM_ELECTRON_VERSION}-linux-${_arch}.zip"+ mkdir -p "${_zd}"+ rm -f "${_zf}"+ ( cd "${ELECTRON_DIST}" && find . $ -type f -o -type l $ -readable -print | zip -@ -0 -q -y "${_zf}" )+ [[ -s "${_zf}" ]] || { echo "ERROR: Failed to generate electron zip (directory not readable?)"; return 1; } find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}" done@@ -102,7 +101,6 @@ sed -i -e " s/@electronversion@/${_electronversion}/g s/@appname@/${pkgname%-git}/g- s/@runname@/app.asar/g " "${srcdir}/${pkgname%-git}.sh" gendesk -q -f -n \ --pkgname="${pkgname%-git}" \@@ -130,10 +128,10 @@ package() { install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}" install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"- local _app_dir="$(_get_app_dir)"- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"- local _src="$(_get_project_dir)"- install -Dm644 "${_src}/src/renderer/assets/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"- install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"- install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"+ rm -rf "$(_get_app_dir)/resources/default_app.asar"+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"+ install -Dm644 "$(_get_project_dir)/src/renderer/assets/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}" }+Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 05:19:21 | Medium | 1 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 10:13:47 | Medium | 1 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |