sonolith

LOW

maintainer opecko14 0 votes scanned 2026-10-24 09:43:11.267611

View on AUR

Why flagged

The `npx tauri build` invocation runs the locally installed `tauri` CLI from the project's own `node_modules` (installed via `npm ci` from the checked-out source), not a remote package; this is standard Tauri build practice. The source is fetched from the project's own GitHub repo with a pinned checksum, Cargo deps are locked, and npm deps come from the project's package-lock.json. The only mild concern is that it's a low-vote personal project, but there is no evidence of malicious behaviour.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The `npx tauri build` invocation runs the locally installed `tauri` CLI from the project's own `node_modules` (installed via `npm ci` from the checked-out source), not a remote package; this is standard Tauri build practice. The source is fetched from the project's own GitHub repo with a pinned checksum, Cargo deps are locked, and npm deps come from the project's package-lock.json. The only mild concern is that it's a low-vote personal project, but there is no evidence of malicious behaviour.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:33 npx tauri build --no-bundle

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: opecko <https://github.com/opecko>
    
      2# AUR package: builds Sonolith from the GitHub release tag. Updated by scripts/aur.sh.
    
      3pkgname=sonolith
    
      4pkgver=2.3.0
    
      5pkgrel=1
    
      6pkgdesc="YouTube Music desktop client"
    
      7url='https://github.com/opecko/sonolith'
    
      8arch=('x86_64')
    
      9license=('MIT')
    
      10# Sonolith was called ytdesk until 2.2.0. The ytdesk packages of the same version are transitional (empty, they
    
      11# depend on this one), so only the real old ones conflict.
    
      12provides=('ytdesk')
    
      13conflicts=('sonolith-bin' "ytdesk<$pkgver" "ytdesk-bin<$pkgver")
    
      14replaces=('ytdesk')
    
      15depends=('webkit2gtk-4.1' 'gtk3' 'libsoup3' 'dbus' 'gst-plugins-base' 'gst-plugins-good' 'gst-libav' 'libayatana-appindicator')
    
      16makedepends=('cargo' 'nodejs' 'npm')
    
      17optdepends=('nodejs: JS runtime for the yt-dlp playback fallback'
    
      18            'gnome-keyring: stores the login cookie (Secret Service)')
    
      19options=('!lto' '!debug')
    
      20source=("$pkgname-$pkgver.tar.gz::https://github.com/opecko/sonolith/archive/refs/tags/v$pkgver.tar.gz")
    
      21sha256sums=('415e1c315e51c3a8937c972c9d5a39bc04d08caaaa81419133fed088a0b2cf1f')
    
      22
    
      23prepare() {
    
      24  cd "$pkgname-$pkgver"
    
      25  export RUSTUP_TOOLCHAIN=stable
    
      26  cargo fetch --locked --manifest-path src-tauri/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')"
    
      27  npm ci
    
      28}
    
      29
    
      30build() {
    
      31  cd "$pkgname-$pkgver"
    
      32  export RUSTUP_TOOLCHAIN=stable
    
      33  npx tauri build --no-bundle
    
      34}
    
      35
    
      36package() {
    
      37  cd "$pkgname-$pkgver"
    
      38  install -Dm755 src-tauri/target/release/sonolith "$pkgdir/usr/bin/sonolith"
    
      39  # The old command keeps working for one release.
    
      40  ln -s sonolith "$pkgdir/usr/bin/ytdesk"
    
      41  install -Dm644 packaging/linux/sonolith.desktop "$pkgdir/usr/share/applications/sonolith.desktop"
    
      42  install -Dm644 src-tauri/icons/32x32.png "$pkgdir/usr/share/icons/hicolor/32x32/apps/sonolith.png"
    
      43  install -Dm644 src-tauri/icons/128x128.png "$pkgdir/usr/share/icons/hicolor/128x128/apps/sonolith.png"
    
      44  install -Dm644 src-tauri/icons/128x128@2x.png "$pkgdir/usr/share/icons/hicolor/256x256/apps/sonolith.png"
    
      45  install -Dm644 src-tauri/icons/icon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/sonolith.png"
    
      46  install -Dm644 src-tauri/app-icon.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/sonolith.svg"
    
      47  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 09:43:11	Low	3
2026-10-24 09:40:04	Medium	2