snapchat-nativefier

LOW

maintainer saltedcoffii 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The flagged non-standard host is for a plain JavaScript file from the AUR itself, which is safe; the package builds from source using nativefier on a legitimate web URL, and the only external downloads are a logo and a benign inject script, posing no execution risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged non-standard host is for a plain JavaScript file from the AUR itself, which is safe; the package builds from source using nativefier on a legitimate web URL, and the only external downloads are a logo and a benign inject script, posing no execution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 "https://upload.wikimedia.org/wikipedia/en/c/c4/Snapchat_logo.svg"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Cassandra Watergate (saltedcoffii) <cassandrajwatergate@gmail.com>
    
      2
    
      3pkgname=snapchat-nativefier
    
      4pkgver=0.1.1
    
      5pkgrel=1
    
      6pkgdesc="Snapchat web built with nativefier (electron)"
    
      7arch=("armv7l" "i686" "x86_64")
    
      8url="https://web.${pkgname%-nativefier}.com"
    
      9license=("custom")
    
      10depends=("gtk3" "libxss" "nss")
    
      11optdepends=("libindicator-gtk3")
    
      12makedepends=("imagemagick" "inkscape" "nodejs-nativefier" "unzip")
    
      13source=(
    
      14  "https://upload.wikimedia.org/wikipedia/en/c/c4/Snapchat_logo.svg"
    
      15  "whatsapp-nativefier-inject.js::https://aur.archlinux.org/cgit/aur.git/plain/whatsapp-nativefier-inject.js?h=whatsapp-nativefier"
    
      16  "${pkgname}.desktop"
    
      17)
    
      18sha256sums=('73b811daaddb6eac1dde7f110850148ca273cb108e4f4cd95ac1d4d1b72eeab2'
    
      19            'SKIP'
    
      20            '46ff7aa6dbe376cf081411419bd30249e5b6babc50abfa2bde15f4d659a64bf4')
    
      21
    
      22build() {
    
      23  cd "${srcdir}"
    
      24
    
      25  inkscape -w 1024 -h 1024 Snapchat_logo.svg -o Snapchat_logo.png
    
      26  magick Snapchat_logo.png -resize 194x194 snapchat-nativefier.png
    
      27
    
      28  nativefier \
    
      29    --name "Snapchat" \
    
      30    --icon "${pkgname}.png" \
    
      31    --width "800px" \
    
      32    --height "600px" \
    
      33    --user-agent "Mozilla/5.0 (X11; Linux $(uname -m)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.167 Safari/537.36" \
    
      34    --inject "whatsapp-nativefier-inject.js" \
    
      35    --verbose \
    
      36    --single-instance \
    
      37    --tray \
    
      38    "${url}"
    
      39}
    
      40
    
      41package() {
    
      42  install -dm755 "${pkgdir}/"{opt,usr/{bin,share/{applications,licenses/${pkgname}}}}
    
      43
    
      44  _folder=$(ls "${srcdir}" | grep "[Ss]napchat[-]*linux-")
    
      45  _binary=$(ls "${srcdir}/${_folder}" | grep "[Ss]napchat")
    
      46
    
      47  cp -rL "${srcdir}/${_folder}" "${pkgdir}/opt/${pkgname}"
    
      48  ln -s "/opt/${pkgname}/${_binary}" "${pkgdir}/usr/bin/${pkgname}"
    
      49  install -Dm644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      50  install -Dm644 "${pkgdir}/opt/${pkgname}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      51  for _size in "192x192" "128x128" "96x96" "64x64" "48x48" "32x32" "24x24" "22x22" "20x20" "16x16" "8x8"; do
    
      52    install -dm755 "${pkgdir}/usr/share/icons/hicolor/${_size}/apps"
    
      53    magick convert "${srcdir}/Snapchat_logo.png" -strip -resize "${_size}" "${pkgdir}/usr/share/icons/hicolor/${_size}/apps/${pkgname}.png"
    
      54  done
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2