snsdeck

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The `npm add -D @electron-forge/plugin-local-electron` installs a package from the npm registry (not an unofficial/personal host). `@electron-forge/plugin-local-electron` is an official package from the electron-forge organization, published on the standard npm registry. Its purpose here is well-understood: it allows electron-forge to use a system-installed Electron binary instead of downloading one, which is exactly the pattern used by many AUR Electron packages to avoid bundling Electron. While it is not listed in package.json's devDependencies ahead of time (it gets added dynamically), it comes from the official npm registry and is a legitimate, well-known package. This is sloppy/non-standard packaging (the dependency should ideally be in package.json already), but it does not represent a genuine supply-chain threat from an unofficial host. The curl to ipinfo.io to detect CN geolocation and conditionally switch registries is mildly unusual but is a common pattern in AUR packages targeting Chinese users. Overall this is low severity — non-standard but not a real security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The `npm add -D @electron-forge/plugin-local-electron` installs a package from the npm registry (not an unofficial/personal host). `@electron-forge/plugin-local-electron` is an official package from the electron-forge organization, published on the standard npm registry. Its purpose here is well-understood: it allows electron-forge to use a system-installed Electron binary instead of downloading one, which is exactly the pattern used by many AUR Electron packages to avoid bundling Electron. While it is not listed in package.json's devDependencies ahead of time (it gets added dynamically), it comes from the official npm registry and is a legitimate, well-known package. This is sloppy/non-standard packaging (the dependency should ideally be in package.json already), but it does not represent a genuine supply-chain threat from an unofficial host. The curl to ipinfo.io to detect CN geolocation and conditionally switch registries is mildly unusual but is a common pattern in AUR packages targeting Chinese users. Overall this is low severity — non-standard but not a real security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:69 NODE_ENV=development npm add -D @electron-forge/plugin-local-electron

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=snsdeck
    
      3pkgver=0.0.3
    
      4_electronversion=26
    
      5_nodeversion=20
    
      6pkgrel=10
    
      7pkgdesc="SNS Viewer like TweetDeck.(Use system-wide electron)"
    
      8arch=('any')
    
      9url="https://github.com/meganii/snsdeck"
    
      10license=('MIT')
    
      11conflicts=("${pkgname}")
    
      12depends=(
    
  "electron${_electronversion}"
    
      14)
    
      15makedepends=(
    
  'gendesk'
    
  'npm'
    
  'nvm'
    
  'curl'
    
  'git'
    
      21)
    
      22source=(
    
  "${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}"
    
  "${pkgname}.sh"
    
      25)
    
      26sha256sums=('7dbd5004b2fc8a2759d71be17cbc098c1b9f25c7defe593bf20644bf3c5b1295'
    
          '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
    
      28_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      33}
    
      34prepare() {
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${pkgname}/g
    
      s/@options@//g
    
  " "${srcdir}/${pkgname}.sh"
    
  _ensure_local_nvm
    
  gendesk -f -n -q \
    
      --pkgname="${pkgname}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="Utility" \
    
      --name="${pkgname}" \
    
      --exec="${pkgname} %U"
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  HOME="${srcdir}/.electron-gyp"
    
  {
    
      echo -e '\n'
    
      #echo 'build_from_source=true'
    
      echo "cache=${srcdir}/.npm_cache"
    
      echo "maxsockets=10"
    
  } >> .npmrc
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      {
    
          echo 'registry=https://registry.npmmirror.com'
    
          echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
    
          echo 'electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/'
    
      } >> .npmrc
    
      find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
    
  fi
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  NODE_ENV=development    npm install
    
  NODE_ENV=development    npm add -D @electron-forge/plugin-local-electron
    
      70}
    
      71build() {
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  local electronDist="/usr/lib/electron${_electronversion}"
    
  sed -i -e "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
    
  {\\
    
      name: \"@electron-forge/plugin-local-electron\",\\
    
      config: {\\
    
          electronPath: \"${electronDist}\"\\
    
      }\\
    
  }," forge.config.js
    
  NODE_ENV=production     npm run package
    
      82}
    
      83package() {
    
  install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/out/${pkgname}-linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname}"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      88}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2