urdu-translator-git

maintainer AMVZEN · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command runs electron-builder locally to package a frontend app; it does not execute arbitrary remote code, and the source is from a legitimate project repository.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs electron-builder locally to package a frontend app; it does not execute arbitrary remote code, and the source is from a legitimate project repository.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:39 npx electron-builder --linux dir

PKGBUILD

1 offending line(s) highlighted

      1pkgname=urdu-translator-git
    
      2pkgver=v1.0.0.r1.g6e4d704
    
      3pkgrel=1
    
      4pkgdesc="A screenshot-to-translation app using EasyOCR and Google Gemini"
    
      5arch=('x86_64')
    
      6url="https://github.com/AMVZEN/UrduLiveTranslator"
    
      7license=('MIT')
    
      8depends=('python' 'python-pip' 'nss' 'alsa-lib' 'gtk3' 'grim' 'slurp')
    
      9makedepends=('npm' 'git')
    
      10provides=('urdu-translator')
    
      11conflicts=('urdu-translator')
    
      12
    
      13# IMPORTANT: Before publishing to AUR, push your code to GitHub and update the URL below!
    
      14# For local testing, we can use a local file path, but pacman/makepkg restricts it. 
    
      15# You should uncomment the github link when doing this for real.
    
      16source=("git+https://github.com/AMVZEN/UrduLiveTranslator.git"
    
      17        "urdu-translator.sh"
    
      18        "urdu-translator.desktop")
    
      19
    
      20sha256sums=('SKIP'
    
      21            'SKIP'
    
      22            'SKIP')
    
      23
    
      24pkgver() {
    
      25  cd "$srcdir/UrduLiveTranslator"
    
      26  git describe --long --tags --always | sed 's/\([^-]*-g\)/r\1/;s/-/./g' || echo $pkgver
    
      27}
    
      28
    
      29build() {
    
      30  cd "$srcdir/UrduLiveTranslator/frontend"
    
      31  
    
      32  # Install frontend dependencies
    
      33  npm install
    
      34  
    
      35  # Build the React vite app
    
      36  npm run build
    
      37  
    
      38  # Package the electron app for Linux (dir format instead of AppImage makes it easier to bundle in /opt)
    
      39  npx electron-builder --linux dir
    
      40}
    
      41
    
      42package() {
    
      43  # 1. Prepare installation directories
    
      44  install -d "$pkgdir/opt/urdu-translator/frontend"
    
      45  install -d "$pkgdir/usr/bin"
    
      46  install -d "$pkgdir/usr/share/applications"
    
      47
    
      48  # 2. Copy the Frontend Electron Bundle
    
      49  cp -r "$srcdir/UrduLiveTranslator/frontend/dist/linux-unpacked/"* "$pkgdir/opt/urdu-translator/frontend/"
    
      50  
    
      51  # 3. Copy the Backend Source
    
      52  # We copy everything in backend so the launcher script can venv/pip install on first run
    
      53  cp -r "$srcdir/UrduLiveTranslator/backend" "$pkgdir/opt/urdu-translator/"
    
      54
    
      55  # Fix permissions
    
      56  chmod -R 755 "$pkgdir/opt/urdu-translator"
    
      57
    
      58  # 4. Install the Desktop entry and Launcher Script
    
      59  install -m 755 "$srcdir/urdu-translator.sh" "$pkgdir/usr/bin/urdu-translator"
    
      60  install -m 644 "$srcdir/urdu-translator.desktop" "$pkgdir/usr/share/applications/"
    
      61
    
      62  # (Extra) Setup icon if you have one. You'll need to add it to your repo and install it here.
    
      63  # install -Dm644 "$srcdir/UrduTranslator/icon.png" "$pkgdir/usr/share/pixmaps/urdu-translator.png"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2