swarm-desktop

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-09-09 03:18:52.192921
View on AUR
Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:106 NODE_ENV=development pnpm add -D @electron-forge/plugin-local-electron

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=swarm-desktop
3_pkgname='Swarm Desktop'
4pkgver=0.56.0
5_electronversion=40
6_nodeversion=24
7pkgrel=1
8pkgdesc="Electron Desktop app that helps you easily spin up and manage Swarm node.(Use system-wide electron)"
9arch=(
10 'aarch64'
11 'armv7h'
12 'x86_64'
13)
14url="https://desktop.ethswarm.org/"
15_ghurl="https://ghfast.top/https://github.com/ethersphere/swarm-desktop"
16license=('BSD-3-Clause')
17conflicts=("${pkgname}")
18depends=(
19 "electron${_electronversion}"
20)
21makedepends=(
22 'gendesk'
23 'npm'
24 'pnpm'
25 'nvm'
26 'curl'
27 'python-setuptools'
28 'git'
29 'jq'
30)
31source=(
32 "${pkgname}-${pkgver}::git+${_ghurl}#tag=v${pkgver}"
33 "${pkgname}.sh"
34)
35sha256sums=('dc57bc474b6f348e0a66aa5bd17d7622f9cc696933296d1c4c387e49ee9ebd5e'
36 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
37_ensure_local_nvm() {
38 local NVM_DIR="${srcdir}/.nvm"
39 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
40 nvm install "${_nodeversion}"
41 nvm use "${_nodeversion}"
42}
43_get_app_dir() {
44 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
45}
46_set_build_env() {
47 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
48 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
49 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
50 export HOME="${srcdir}/.electron-gyp"
51 {
52 export PNPM_LINK_WORKSPACE_PACKAGES=true
53 export pnpm_config_block_exotic_subdeps=false
54 export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
55 export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
56 export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
57 export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
58 export PNPM_SHAMEFULLY_HOIST=true
59 export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
60 export PNPM_NODE_LINKER=hoisted
61 export PNPM_NETWORK_CONCURRENCY=32
62 }
63 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
64 {
65 export pnpm_config_registry="https://registry.npmmirror.com"
66 export npm_config_registry="https://registry.npmmirror.com"
67 export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
68 export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
69 export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
70 }
71 fi
72}
73_get_electron_version() {
74 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
75 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
76 [[ -z "${_elec_ver}" ]] && return 1
77 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
78}
79prepare() {
80 cd "${srcdir}/${pkgname}-${pkgver}"
81 _get_electron_version
82 sed -i -e "
83 s/@electronversion@/${_electronversion}/g
84 s/@appname@/${pkgname}/g
85 s/@runname@/app.asar/g
86 s/@cfgdirname@/${_pkgname}/g
87 " "${srcdir}/${pkgname}.sh"
88 gendesk -q -f -n \
89 --pkgname="${pkgname}" \
90 --pkgdesc="${pkgdesc}" \
91 --categories="Utility" \
92 --name="${_pkgname}" \
93 --exec="${pkgname} %U"
94 _set_build_env
95 _ensure_local_nvm
96 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
97 sed -i "s/set this to true or false/true/g" pnpm-workspace.yaml
98 sed -i "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
99 {\\
100 name: \"@electron-forge/plugin-local-electron\",\\
101 config: {\\
102 electronPath: \'${ELECTRON_DIST}\',\\
103 },\\
104 }," forge.config.*
105 NODE_ENV=development pnpm install
106 NODE_ENV=development pnpm add -D @electron-forge/plugin-local-electron
107 cd "${srcdir}/${pkgname}-${pkgver}/ui"
108 NODE_ENV=development pnpm install
109}
110build() {
111 cd "${srcdir}/${pkgname}-${pkgver}"
112 _set_build_env
113 _ensure_local_nvm
114 NODE_ENV=production pnpm run build
115 NODE_ENV=production pnpm run package
116}
117package() {
118 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
119 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
120 local _app_dir=$(_get_app_dir)
121 cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
122 install -Dm644 "${srcdir}/${pkgname}-${pkgver}/assets/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
123 install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
124 install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
125}
126

Changes since previous scan

--- PKGBUILD @ 2026-08-27 09:31
+++ PKGBUILD @ 2026-09-09 03:18
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=swarm-desktop
_pkgname='Swarm Desktop'
-pkgver=0.55.2
+pkgver=0.56.0
_electronversion=40
_nodeversion=24
pkgrel=1
@@ -32,7 +32,7 @@
"${pkgname}-${pkgver}::git+${_ghurl}#tag=v${pkgver}"
"${pkgname}.sh"
)
-sha256sums=('ec05d10feb1d3e5e0516008daa9f239ecad44c5ccce7fb2bc3f52423f306b226'
+sha256sums=('dc57bc474b6f348e0a66aa5bd17d7622f9cc696933296d1c4c387e49ee9ebd5e'
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
@@ -95,7 +95,15 @@
_ensure_local_nvm
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
sed -i "s/set this to true or false/true/g" pnpm-workspace.yaml
+ sed -i "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
+ {\\
+ name: \"@electron-forge/plugin-local-electron\",\\
+ config: {\\
+ electronPath: \'${ELECTRON_DIST}\',\\
+ },\\
+ }," forge.config.*
NODE_ENV=development pnpm install
+ NODE_ENV=development pnpm add -D @electron-forge/plugin-local-electron
cd "${srcdir}/${pkgname}-${pkgver}/ui"
NODE_ENV=development pnpm install
}

Scan history

Scanned at (UTC)SeverityRules
2026-09-09 03:18:52 Medium 1
2026-08-27 09:31:53 Clean 0
2026-07-27 09:34:56 Clean 0
2026-07-09 01:29:43 Clean 0
2026-07-09 00:22:38 Low 2
2026-07-08 00:26:52 Low 2
2026-07-07 00:22:52 Low 2
2026-07-06 00:10:58 Low 2
2026-07-05 00:27:08 Low 2
2026-07-04 00:27:25 Low 2
2026-07-03 00:17:07 Low 2
2026-07-02 00:22:12 Low 2
2026-07-01 00:30:02 Low 2
2026-06-30 00:15:06 Low 2
2026-06-29 00:20:06 Low 2
2026-06-28 00:09:41 Low 2
2026-06-27 00:00:51 Low 2
2026-06-26 00:27:06 Low 2
2026-06-25 00:08:41 Low 2
2026-06-24 00:08:06 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion