solarbg-git

MEDIUM

maintainer VardanHeroic 0 votes scanned 2026-10-29 15:52:51.405531

View on AUR

Why flagged

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:27 npx tsc

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vardan Tarayan <vardanheroic@gmail.com>
    
      2pkgname='solarbg-git'
    
      3pkgrel=1
    
      4pkgver=2.0.2.r0.g66965eb
    
      5pkgdesc="Sun altitude based wallpapers "
    
      6arch=('any')
    
      7url="https://github.com/VardanHeroic/solarbg"
    
      8license=('GPL-3.0-only')
    
      9depends=('nodejs>=17.1.0')
    
      10makedepends=('git' 'npm')
    
      11optdepends=(
    
      12	'feh: x11 tiling wm support',
    
      13	'swaybg: wlroots based wayland compositors support')
    
      14source=('solarbg-git::git+https://github.com/VardanHeroic/solarbg.git#branch=master')
    
      15md5sums=('SKIP')
    
      16replaces=('solarbg')
    
      17
    
      18
    
      19pkgver() {
    
      20	cd "$pkgname"
    
      21	git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      22}
    
      23
    
      24build() {
    
      25	cd "$pkgname"
    
      26	npm install --include=dev
    
      27	npx tsc
    
      28}
    
      29
    
      30package() {
    
      31	cd "$pkgname"
    
      32	
    
      33    local tarball
    
      34    tarball=$(npm pack --silent --pack-destination "$srcdir")
    
      35
    
      36    npm install -g --prefix "$pkgdir/usr" "$srcdir/$tarball"
    
      37
    
      38}
    
      39

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-10-29 15:52
@@ -1,18 +1,19 @@
-# Maintainer: Vardan Tarayan <tarayanvardan@gmail.com>
+# Maintainer: Vardan Tarayan <vardanheroic@gmail.com>
 pkgname='solarbg-git'
-pkgrel=4
-pkgver="v1.2.0.r0.gb4bd1bf"
+pkgrel=1
+pkgver=2.0.2.r0.g66965eb
 pkgdesc="Sun altitude based wallpapers "
-arch=('x86_64')
+arch=('any')
 url="https://github.com/VardanHeroic/solarbg"
-license=('GPL')
-depends=('nodejs>=16.0.0')
+license=('GPL-3.0-only')
+depends=('nodejs>=17.1.0')
 makedepends=('git' 'npm')
 optdepends=(
 	'feh: x11 tiling wm support',
 	'swaybg: wlroots based wayland compositors support')
-source=('solarbg-git::git+https://github.com/VardanHeroic/solarbg.git')
+source=('solarbg-git::git+https://github.com/VardanHeroic/solarbg.git#branch=master')
 md5sums=('SKIP')
+replaces=('solarbg')
 
 
 pkgver() {
@@ -22,19 +23,17 @@
 
 build() {
 	cd "$pkgname"
-	npm install --production
+	npm install --include=dev
+	npx tsc
 }
 
 package() {
 	cd "$pkgname"
-	appdir=/usr/lib/${pkgname} 
-	bindir=/usr/bin/
+	
+    local tarball
+    tarball=$(npm pack --silent --pack-destination "$srcdir")
 
-	install -d "${pkgdir}"${appdir}
-	cp -r * "${pkgdir}"${appdir}
-
-	install -d "${pkgdir}"${bindir}
-	cp scripts/solarbg "${pkgdir}"${bindir} 
+    npm install -g --prefix "$pkgdir/usr" "$srcdir/$tarball"
 
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 15:52:51	Medium	1
2026-06-18 16:11:54	Clean	0