trufos-git
maintainer zxp19821005
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The PKGBUILD runs 'yarn add -D @electron-forge/plugin-local-electron' during prepare(), fetching and installing an npm package that is not pinned in the project's lockfile (it's added dynamically, outside the normal 'yarn install' from the committed yarn.lock). This means the package version is resolved at build time from the npm registry without a checksum/integrity guarantee baked into the lockfile, creating a real supply-chain risk: a compromised or malicious version of @electron-forge/plugin-local-electron would be executed during the build process. The package itself is a legitimate Electron Forge plugin from the official @electron-forge scope on npm, which reduces the likelihood of it being malicious, but the pattern of dynamically adding an unlocked dependency that participates in the build is a genuine medium-severity supply-chain concern. The rest of the PKGBUILD follows common AUR patterns for Electron apps using system electron.
Triggered rules
MEDIUM
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:90
NODE_ENV=development yarn add -D @electron-forge/plugin-local-electron
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD runs 'yarn add -D @electron-forge/plugin-local-electron' during prepare(), fetching and installing an npm package that is not pinned in the project's lockfile (it's added dynamically, outside the normal 'yarn install' from the committed yarn.lock). This means the package version is resolved at build time from the npm registry without a checksum/integrity guarantee baked into the lockfile, creating a real supply-chain risk: a compromised or malicious version of @electron-forge/plugin-local-electron would be executed during the build process. The package itself is a legitimate Electron Forge plugin from the official @electron-forge scope on npm, which reduces the likelihood of it being malicious, but the pattern of dynamically adding an unlocked dependency that participates in the build is a genuine medium-severity supply-chain concern. The rest of the PKGBUILD follows common AUR patterns for Electron apps using system electron.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=trufos-git
3
_pkgname=Trufos
4
pkgver=0.8.0.r0.g3ea2a57
5
_electronversion=41
6
_nodeversion=24
7
pkgrel=1
8
pkgdesc="A modern, open source REST client app.(Use system-wide electron)"
9
arch=('any')
10
url="https://exxeta.github.io/trufos/"
11
_ghurl="https://github.com/EXXETA/trufos"
12
license=('GPL-3.0-or-later')
13
provides=("${pkgname%-git}=${pkgver%.r*}")
14
conflicts=("${pkgname%-git}")
15
depends=(
16
"electron${_electronversion}"
17
)
18
makedepends=(
19
'npm'
20
'nvm'
21
'git'
22
'curl'
23
'gendesk'
24
'jq'
25
)
26
source=(
27
"${pkgname//-/.}::git+${_ghurl}.git"
28
"${pkgname%-git}.sh"
29
)
30
sha256sums=('SKIP'
31
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
32
pkgver() {
33
cd "${srcdir}/${pkgname//-/.}"
34
set -o pipefail
35
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
36
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
37
}
38
_ensure_local_nvm() {
39
local NVM_DIR="${srcdir}/.nvm"
40
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
41
nvm install "${_nodeversion}"
42
nvm use "${_nodeversion}"
43
}
44
_get_electron_version() {
45
_elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -name "node_modules" \
46
-exec jq -r '.devDependencies.electron // empty' {} + 2>/dev/null | grep -v "^$" | head -n 1)
47
_elec_ver=$(echo "${_elec_ver}" | sed 's/[^0-9.]//g')
48
_main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
49
echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
50
}
51
prepare() {
52
cd "${srcdir}/${pkgname//-/.}"
53
_get_electron_version
54
sed -i -e "
55
s/@electronversion@/${_electronversion}/g
56
s/@appname@/${pkgname%-git}/g
57
s/@runname@/app.asar/g
58
s/@cfgdirname@/${_pkgname}/g
59
" "${srcdir}/${pkgname%-git}.sh"
60
gendesk -q -f -n \
61
--pkgname="${pkgname%-git}" \
62
--pkgdesc="${pkgdesc}" \
63
--categories="Development" \
64
--name="${_pkgname}" \
65
--exec="${pkgname%-git} %U"
66
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
67
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
68
local HOME="${srcdir}/.electron-gyp"
69
mkdir -p "${srcdir}/.electron-gyp"
70
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
71
{
72
export ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
73
export ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
74
export YARN_CACHE_FOLDER="${srcdir}/.yarn/cache"
75
export YARN_GLOBAL_FOLDER="${srcdir}/.yarn/global"
76
export YARN_NETWORK_CONCURRENCY=32
77
sed -i '/^npmRegistryServer:/d' .yarnrc.yml
78
echo 'npmRegistryServer: "https://registry.npmmirror.com"' >> .yarnrc.yml
79
}
80
81
find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g" {} +
82
fi
83
_ensure_local_nvm
84
find src -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
85
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
86
_yarnver=`grep "yarn@" package.json | awk '{print $2}' | sed "s/\"//g;s/yarn@//g;s/,//g"`
87
corepack enable yarn
88
echo y | yarn version "${_yarnver}"
89
NODE_ENV=development yarn install
90
NODE_ENV=development yarn add -D @electron-forge/plugin-local-electron
91
}
92
build() {
93
cd "${srcdir}/${pkgname//-/.}"
94
_ensure_local_nvm
95
local electronDist="/usr/lib/electron${_electronversion}"
96
sed -i "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
97
{\\
98
name: \"@electron-forge/plugin-local-electron\",\\
99
config: {\\
100
electronPath: \'${electronDist}\',\\
101
},\\
102
}," forge.config.*
103
NODE_ENV=production yarn run package
104
}
105
package() {
106
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
107
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
108
local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
109
cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
110
_icon_sizes=(256 512 1024)
111
for _icons in "${_icon_sizes[@]}";do
112
install -Dm644 "${srcdir}/${pkgname//-/.}/images/logo-${_icons}.png" \
113
"${pkgdir}/usr/share/icons/hicolor/${_icons}x${_icons}/apps/${pkgname%-git}.png"
114
done
115
install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
116
install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
117
}
118
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |