vega-nostr-git
LOW
maintainer hoornet
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The `npx tauri build` command runs a build tool from the project's own source repository, which is a normal part of building a Tauri application; the Tauri CLI is pulled from npm as a dev dependency but is not executing untrusted remote code in a malicious context.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The `npx tauri build` command runs a build tool from the project's own source repository, which is a normal part of building a Tauri application; the Tauri CLI is pulled from npm as a dev dependency but is not executing untrusted remote code in a malicious context.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:56
npx tauri build --no-bundle -- --locked
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: hoornet <hoornet@users.noreply.github.com>
2
pkgname=vega-nostr-git
3
pkgver=0.15.7
4
pkgrel=1
5
pkgdesc="Cross-platform Nostr desktop client with Lightning integration"
6
arch=('x86_64')
7
url="https://github.com/hoornet/vega"
8
license=('MIT')
9
depends=(
10
'webkit2gtk-4.1'
11
'gtk3'
12
'libayatana-appindicator'
13
'openssl'
14
'gst-plugins-base'
15
'gst-plugins-good'
16
'gst-libav'
17
)
18
makedepends=(
19
'rust'
20
'nodejs'
21
'npm'
22
'git'
23
)
24
optdepends=(
25
'gnome-keyring: persistent key storage (any Secret Service provider works)'
26
'kwallet: Secret Service provider on KDE'
27
)
28
provides=('vega-nostr')
29
conflicts=('vega-nostr')
30
options=('!debug')
31
source=("$pkgname::git+https://github.com/hoornet/vega.git")
32
sha256sums=('SKIP')
33
34
pkgver() {
35
cd "$pkgname"
36
git describe --tags --long 2>/dev/null | sed 's/^v//;s/-/.r/;s/-/./' || echo "$pkgver"
37
}
38
39
build() {
40
cd "$pkgname"
41
# Reset makepkg flags — they interfere with Rust cc crate
42
# compiling bundled SQLite and Ring assembly
43
unset CFLAGS CXXFLAGS LDFLAGS
44
45
# `npm ci --ignore-scripts`, never `npm install` — this mirrors
46
# .github/workflows/release.yml. `install` re-resolves inside the caret
47
# ranges, so a compromised patch release could reach a user's build
48
# without ever appearing in the reviewed lockfile, and postinstall
49
# scripts run as the building user. This package builds on the user's
50
# own machine, so that gap is theirs, not CI's.
51
npm ci --ignore-scripts
52
53
# `-- --locked` forwards to cargo (the Tauri CLI passes trailing args
54
# through). Cargo's equivalent of `npm ci`: refuse to re-resolve, fail
55
# instead of silently building a lockfile nobody reviewed.
56
npx tauri build --no-bundle -- --locked
57
}
58
59
package() {
60
cd "$pkgname"
61
62
install -Dm755 "src-tauri/target/release/vega" \
63
"$pkgdir/usr/bin/vega"
64
65
# Strip build paths from binary (fixes $srcdir reference warning)
66
strip --strip-unneeded "$pkgdir/usr/bin/vega"
67
68
# Icons
69
install -Dm644 "src-tauri/icons/32x32.png" \
70
"$pkgdir/usr/share/icons/hicolor/32x32/apps/vega.png"
71
install -Dm644 "src-tauri/icons/128x128.png" \
72
"$pkgdir/usr/share/icons/hicolor/128x128/apps/vega.png"
73
install -Dm644 "src-tauri/icons/128x128@2x.png" \
74
"$pkgdir/usr/share/icons/hicolor/256x256/apps/vega.png"
75
76
# Desktop entry
77
install -Dm644 /dev/stdin \
78
"$pkgdir/usr/share/applications/vega.desktop" << 'EOF'
79
[Desktop Entry]
80
Name=Vega
81
Comment=Nostr desktop client
82
Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 /usr/bin/vega
83
Icon=vega
84
Type=Application
85
Categories=Network;InstantMessaging;
86
StartupNotify=true
87
EOF
88
89
install -Dm644 "LICENSE" \
90
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
91
}
92
Changes since previous scan
--- PKGBUILD @ 2026-09-13 00:19+++ PKGBUILD @ 2026-09-17 00:27@@ -1,6 +1,6 @@ # Maintainer: hoornet <hoornet@users.noreply.github.com> pkgname=vega-nostr-git-pkgver=0.15.6+pkgver=0.15.7 pkgrel=1 pkgdesc="Cross-platform Nostr desktop client with Lightning integration" arch=('x86_64')@@ -41,8 +41,19 @@ # Reset makepkg flags — they interfere with Rust cc crate # compiling bundled SQLite and Ring assembly unset CFLAGS CXXFLAGS LDFLAGS- npm install- npx tauri build --no-bundle++ # `npm ci --ignore-scripts`, never `npm install` — this mirrors+ # .github/workflows/release.yml. `install` re-resolves inside the caret+ # ranges, so a compromised patch release could reach a user's build+ # without ever appearing in the reviewed lockfile, and postinstall+ # scripts run as the building user. This package builds on the user's+ # own machine, so that gap is theirs, not CI's.+ npm ci --ignore-scripts++ # `-- --locked` forwards to cargo (the Tauri CLI passes trailing args+ # through). Cargo's equivalent of `npm ci`: refuse to re-resolve, fail+ # instead of silently building a lockfile nobody reviewed.+ npx tauri build --no-bundle -- --locked } package() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 13:14:45 | Medium | 1 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 21:49:23 | Medium | 1 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |