super-productivity-git
LOW
maintainer tippfehlr
3 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The npx command runs electron-builder on the locally checked-out project source, which is a standard part of building the application; it does not execute arbitrary remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this HIGH, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs electron-builder on the locally checked-out project source, which is a standard part of building the application; it does not execute arbitrary remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
High
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell.
-
PKGBUILD:54
npx electron-builder --linux --dir \
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jonathan Grotelüschen <tippfehlr@archlinux.org>
2
# Contributor: Mahdi Sarikhani <mahdisarikhani@outlook.com>
3
# Contributor: Anna <morganamilo@gmail.com>
4
5
pkgname=super-productivity-git
6
_name=super-productivity
7
pkgver=18.8.0.r82.gfcc421639
8
pkgrel=1
9
pkgdesc="An advanced todo list app with timeboxing and time tracking capabilities"
10
arch=('any')
11
url="https://super-productivity.com"
12
license=('MIT')
13
_electron=electron41
14
depends=('bash' $_electron 'hicolor-icon-theme')
15
makedepends=('cargo' 'nvm' 'git')
16
provides=($_name 'superproductivity')
17
conflicts=($_name 'superproductivity')
18
source=(
19
"git+https://github.com/super-productivity/super-productivity"
20
"$_name.desktop"
21
"$_name.sh"
22
)
23
sha256sums=('SKIP'
24
'195157267a8c6159a7ecbf47930431f46913d1e06edb96ed200e3a77f9e8ee45'
25
'6d4e3f28b3be0530a473af6a6f6270045cc2c60cac8cf02a9a3bd43036ccd448')
26
27
_ensure_local_nvm() {
28
which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
29
export NVM_DIR="$srcdir/.nvm"
30
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
31
}
32
33
prepare() {
34
_ensure_local_nvm
35
36
sed -i "s/@ELECTRON@/$_electron/" $_name.sh
37
38
cd $_name
39
nvm install
40
}
41
42
pkgver() {
43
cd $_name
44
git describe --long | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
45
}
46
47
build() {
48
_ensure_local_nvm
49
50
cd $_name
51
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
52
npm install
53
npm run build
54
npx electron-builder --linux --dir \
55
--config.electronDist="/usr/lib/$_electron" \
56
--config.electronVersion="$(cat /usr/lib/$_electron/version)"
57
}
58
59
package() {
60
install -Dm755 $_name.sh "$pkgdir/usr/bin/$_name"
61
install -Dm644 $_name.desktop -t "$pkgdir/usr/share/applications/"
62
63
cd $_name
64
install -Dm644 .tmp/app-builds/linux-unpacked/resources/app.asar -t "$pkgdir/usr/lib/$_name/"
65
for i in 16 32 48 64 128 256 512 1024; do
66
install -Dm644 "build/icons/${i}x${i}.png" "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$_name.png"
67
done
68
install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
69
}
70
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |