super-productivity-git
maintainer tippfehlr
· 3 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The npx command runs electron-builder on the locally checked-out project source, which is a standard part of building the application; it does not execute arbitrary remote code.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this HIGH, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs electron-builder on the locally checked-out project source, which is a standard part of building the application; it does not execute arbitrary remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
HIGH
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell.
-
PKGBUILD:54
npx electron-builder --linux --dir \
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jonathan Grotelüschen <tippfehlr@archlinux.org>
2
# Contributor: Mahdi Sarikhani <mahdisarikhani@outlook.com>
3
# Contributor: Anna <morganamilo@gmail.com>
4
5
pkgname=super-productivity-git
6
_name=super-productivity
7
pkgver=18.8.0.r82.gfcc421639
8
pkgrel=1
9
pkgdesc="An advanced todo list app with timeboxing and time tracking capabilities"
10
arch=('any')
11
url="https://super-productivity.com"
12
license=('MIT')
13
_electron=electron41
14
depends=('bash' $_electron 'hicolor-icon-theme')
15
makedepends=('cargo' 'nvm' 'git')
16
provides=($_name 'superproductivity')
17
conflicts=($_name 'superproductivity')
18
source=(
19
"git+https://github.com/super-productivity/super-productivity"
20
"$_name.desktop"
21
"$_name.sh"
22
)
23
sha256sums=('SKIP'
24
'195157267a8c6159a7ecbf47930431f46913d1e06edb96ed200e3a77f9e8ee45'
25
'6d4e3f28b3be0530a473af6a6f6270045cc2c60cac8cf02a9a3bd43036ccd448')
26
27
_ensure_local_nvm() {
28
which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
29
export NVM_DIR="$srcdir/.nvm"
30
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
31
}
32
33
prepare() {
34
_ensure_local_nvm
35
36
sed -i "s/@ELECTRON@/$_electron/" $_name.sh
37
38
cd $_name
39
nvm install
40
}
41
42
pkgver() {
43
cd $_name
44
git describe --long | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
45
}
46
47
build() {
48
_ensure_local_nvm
49
50
cd $_name
51
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
52
npm install
53
npm run build
54
npx electron-builder --linux --dir \
55
--config.electronDist="/usr/lib/$_electron" \
56
--config.electronVersion="$(cat /usr/lib/$_electron/version)"
57
}
58
59
package() {
60
install -Dm755 $_name.sh "$pkgdir/usr/bin/$_name"
61
install -Dm644 $_name.desktop -t "$pkgdir/usr/share/applications/"
62
63
cd $_name
64
install -Dm644 .tmp/app-builds/linux-unpacked/resources/app.asar -t "$pkgdir/usr/lib/$_name/"
65
for i in 16 32 48 64 128 256 512 1024; do
66
install -Dm644 "build/icons/${i}x${i}.png" "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$_name.png"
67
done
68
install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
69
}
70
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |