splayer-git

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The `pnpm add -w object-inspect side-channel-list side-channel-map side-channel-weakmap` call installs additional packages from the npm registry during prepare(). These are well-known, legitimate npm packages (object-inspect is a widely-used utility; side-channel-* are standard security-related utilities from the same ecosystem). They are fetched from the official npm registry (or npmmirror.com for CN users, which is a well-established official mirror). This is a common pattern in Electron app packaging where transitive dependency issues need to be resolved manually. The packages themselves are not suspicious, the registry sources are legitimate, and the overall build pattern (using system electron, pnpm workspace, electron-builder) is standard for AUR Electron packages. The geographic mirror detection using ipinfo.io is slightly unusual but only affects registry URLs, not the packages themselves. This does not rise to a medium supply-chain concern — it's sloppy/non-standard packaging but not a security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The `pnpm add -w object-inspect side-channel-list side-channel-map side-channel-weakmap` call installs additional packages from the npm registry during prepare(). These are well-known, legitimate npm packages (object-inspect is a widely-used utility; side-channel-* are standard security-related utilities from the same ecosystem). They are fetched from the official npm registry (or npmmirror.com for CN users, which is a well-established official mirror). This is a common pattern in Electron app packaging where transitive dependency issues need to be resolved manually. The packages themselves are not suspicious, the registry sources are legitimate, and the overall build pattern (using system electron, pnpm workspace, electron-builder) is standard for AUR Electron packages. The geographic mirror detection using ipinfo.io is slightly unusual but only affects registry URLs, not the packages themselves. This does not rise to a medium supply-chain concern — it's sloppy/non-standard packaging but not a security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:104 NODE_ENV=development pnpm add -w object-inspect side-channel-list side-channel-map side-channel-weakmap

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=splayer-git
    
      3_pkgname=SPlayer
    
      4pkgver=3.1.1.r0.g28b76ba
    
      5_electronversion=41
    
      6_nodeversion=22
    
      7pkgrel=1
    
      8pkgdesc="A minimalist music player.(Use system-wide electron) 一个简约的音乐播放器，支持逐字歌词，下载歌曲，展示评论区，音乐云盘及歌单管理，音乐频谱，移动端基础适配 | 网易云音乐."
    
      9arch=('any')
    
      10url="http://splayer.imsyy.top"
    
      11_ghurl="https://github.com/imsyy/SPlayer"
    
      12license=("AGPL-3.0-only")
    
      13conflicts=("${pkgname%-git}")
    
      14provides=("${pkgname%-git}=${pkgver%.r*}")
    
      15depends=(
    
  "electron${_electronversion}"
    
  'libvips'
    
      18)
    
      19makedepends=(
    
  'npm'
    
  'git'
    
  'nvm'
    
  'gendesk'
    
  'curl'
    
  'pnpm'
    
  'jq'
    
  'rustup'
    
      28)
    
      29source=(
    
  "${pkgname//-/.}::git+${_ghurl}.git"
    
  "${pkgname%-git}.sh"
    
      32)
    
      33sha256sums=('SKIP'
    
          'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      35pkgver() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  set -o pipefail
    
  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      40}
    
      41_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      46}
    
      47_get_electron_version() {
    
  _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
    
      -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
    
  [[ -z "${_elec_ver}" ]] && return 1
    
  echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
    
      52}
    
      53prepare() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  _get_electron_version
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname%-git}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${_pkgname}/g
    
  " "${srcdir}/${pkgname%-git}.sh"
    
  gendesk -q -f -n \
    
      --pkgname="${pkgname%-git}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="AudioVideo" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname%-git} %U"
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  export CARGO_HOME="${srcdir}/.cargo"
    
  HOME="${srcdir}/.electron-gyp"
    
  {
    
      export PNPM_LINK_WORKSPACE_PACKAGES=true
    
      export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
    
      export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
    
      export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
    
      export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
    
      export PNPM_SHAMEFULLY_HOIST=true
    
      export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
    
      export PNPM_NODE_LINKER=hoisted
    
      export PNPM_NETWORK_CONCURRENCY=32
    
  }
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      {
    
          export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
    
          export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
    
          export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
    
          export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
    
          export RUSTUP_DIST_SERVER="https://rsproxy.cn"
    
    export RUSTUP_UPDATE_ROOT="https://rsproxy.cn/rustup"
    
      }
    
  fi
    
  _ensure_local_nvm
    
  if [ ! -f .env ]; then
    
      cp .env.example .env
    
  else
    
      echo ".env file already exists. Skipping the copy step."
    
  fi
    
  rustup default stable
    
  find electron -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
    
  pnpm remove --save-dev @electron-toolkit/utils
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  NODE_ENV=development    pnpm install
    
  NODE_ENV=development    pnpm add -w object-inspect side-channel-list side-channel-map side-channel-weakmap
    
      105}
    
      106build() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  _ensure_local_nvm
    
  local electronDist="/usr/lib/electron${_electronversion}"
    
  NODE_ENV=production     pnpm run build
    
  NODE_ENV=production     pnpm -c exec "electron-builder --linux dir -c.electronDist=${electronDist} --config electron-builder.config.ts"
    
  rm -rf "${srcdir}/${pkgname//-/.}/dist/linux-"*/resources/app.asar.unpacked/node_modules/font-list/libs/{darwin,win32}
    
      113}
    
      114package() {
    
  install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
    
  local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -exec dirname {} + | head -n 1)
    
  cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
    
  _icon_sizes=(16x16 32x32 96x96 192x192 256x256 512x512)
    
  for _icons in "${_icon_sizes[@]}";do
    
      install -Dm644 "${srcdir}/${pkgname//-/.}/public/icons/favicon-${_icons}.png" \
    
          "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
    
  done
    
  install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      126}
    
      127

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2