swarm-desktop

LOW

maintainer zxp19821005 0 votes scanned 2026-10-24 00:14:55.209548

View on AUR

Why flagged

The flagged pattern involves pnpm installing dependencies during build, but this is part of the normal build process for a Node.js/Electron application using the project's own source from a tagged release; the packages are resolved from standard npm registries (with mirrors for China) and no untrusted or obfuscated code execution occurs.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves pnpm installing dependencies during build, but this is part of the normal build process for a Node.js/Electron application using the project's own source from a tagged release; the packages are resolved from standard npm registries (with mirrors for China) and no untrusted or obfuscated code execution occurs.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:106 NODE_ENV=development pnpm add -D @electron-forge/plugin-local-electron

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=swarm-desktop
    
      3_pkgname='Swarm Desktop'
    
      4pkgver=0.56.0
    
      5_electronversion=40
    
      6_nodeversion=24
    
      7pkgrel=1
    
      8pkgdesc="Electron Desktop app that helps you easily spin up and manage Swarm node.(Use system-wide electron)"
    
      9arch=(
    
  'aarch64'
    
  'armv7h'
    
  'x86_64'
    
      13)
    
      14url="https://desktop.ethswarm.org/"
    
      15_ghurl="https://ghfast.top/https://github.com/ethersphere/swarm-desktop"
    
      16license=('BSD-3-Clause')
    
      17conflicts=("${pkgname}")
    
      18depends=(
    
  "electron${_electronversion}"
    
      20)
    
      21makedepends=(
    
  'gendesk'
    
  'npm'
    
  'pnpm'
    
  'nvm'
    
  'curl'
    
  'python-setuptools'
    
  'git'
    
  'jq'
    
      30)
    
      31source=(
    
  "${pkgname}-${pkgver}::git+${_ghurl}#tag=v${pkgver}"
    
  "${pkgname}.sh"
    
      34)
    
      35sha256sums=('dc57bc474b6f348e0a66aa5bd17d7622f9cc696933296d1c4c387e49ee9ebd5e'
    
          'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      37_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      42}
    
      43_get_app_dir() {
    
  find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      45}
    
      46_set_build_env() {
    
  export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  export HOME="${srcdir}/.electron-gyp"
    
  {
    
      export PNPM_LINK_WORKSPACE_PACKAGES=true
    
      export pnpm_config_block_exotic_subdeps=false
    
      export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
    
      export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
    
      export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
    
      export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
    
      export PNPM_SHAMEFULLY_HOIST=true
    
      export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
    
      export PNPM_NODE_LINKER=hoisted
    
      export PNPM_NETWORK_CONCURRENCY=32
    
  }
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      {
    
          export pnpm_config_registry="https://registry.npmmirror.com"
    
          export npm_config_registry="https://registry.npmmirror.com"
    
          export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
    
          export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
    
          export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
    
      }
    
  fi
    
      72}
    
      73_get_electron_version() {
    
  _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
    
      -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
    
  [[ -z "${_elec_ver}" ]] && return 1
    
  echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
    
      78}
    
      79prepare() {
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  _get_electron_version
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${_pkgname}/g
    
  " "${srcdir}/${pkgname}.sh"
    
  gendesk -q -f -n \
    
      --pkgname="${pkgname}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="Utility" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname} %U"
    
  _set_build_env
    
  _ensure_local_nvm
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  sed -i "s/set this to true or false/true/g" pnpm-workspace.yaml
    
  sed -i "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
    
{\\
    
name: \"@electron-forge/plugin-local-electron\",\\
    
config: {\\
    
	electronPath: \'${ELECTRON_DIST}\',\\
    
},\\
    
}," forge.config.*
    
  NODE_ENV=development    pnpm install
    
  NODE_ENV=development    pnpm add -D @electron-forge/plugin-local-electron
    
  cd "${srcdir}/${pkgname}-${pkgver}/ui"
    
  NODE_ENV=development    pnpm install
    
      109}
    
      110build() {
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  _set_build_env
    
  _ensure_local_nvm
    
  NODE_ENV=production     pnpm run build
    
  NODE_ENV=production     pnpm run package
    
      116}
    
      117package() {
    
  install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
    
local _app_dir=$(_get_app_dir)
    
cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname}/"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/assets/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      125}
    
      126

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2