vesktop-keybindings-git

LOW

maintainer Mylloon 0 votes scanned 2026-09-26 19:17:50.855674

View on AUR

Why flagged

The flagged `pnpm add uiohook-napi` installs a real, published npm package (a native Node.js binding for keyboard/mouse hooks) from the official npm registry during build; it is a legitimate dependency for the global-shortcuts feature being added, not an exfiltration or obfuscated payload. The package builds from a fork of the official Vesktop repo, and the only real concern is the SKIP'd checksum on the git source and the low-vote status of a fork, which is normal for a feature-branch AUR package rather than evidence of malice.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The flagged `pnpm add uiohook-napi` installs a real, published npm package (a native Node.js binding for keyboard/mouse hooks) from the official npm registry during build; it is a legitimate dependency for the global-shortcuts feature being added, not an exfiltration or obfuscated payload. The package builds from a fork of the official Vesktop repo, and the only real concern is the SKIP'd checksum on the git source and the low-vote status of a fork, which is normal for a feature-branch AUR package rather than evidence of malice.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:52 pnpm add uiohook-napi --allow-build=uiohook-napi

PKGBUILD

1 offending line(s) highlighted

      1# shellcheck disable=SC2034,SC2148,SC2154
    
      2
    
      3# Maintainer: zt <zt@zt64.dev>
    
      4# Maintainer: cookie <kyliepc@proton.me>
    
      5_pkgname=vesktop
    
      6pkgname=vesktop-keybindings-git
    
      7pkgdesc="A standalone Electron-based Discord app with Vencord & improved Linux support"
    
      8pkgver=r383.9716ff4
    
      9pkgrel=1
    
      10
    
      11arch=("x86_64" "aarch64")
    
      12url="https://github.com/Covkie/Vesktop"
    
      13license=('GPL-3.0-only')
    
      14
    
      15depends=('alsa-lib' 'gtk3' 'nss')
    
      16makedepends=('git' 'pnpm' 'npm')
    
      17optdepends=(
    
      18  'libnotify: Notifications'
    
      19  'xdg-utils: Open links, files, etc'
    
      20)
    
      21
    
      22provides=("vesktop")
    
      23conflicts=('vesktop')
    
      24
    
      25source=(
    
      26  "$_pkgname::git+$url.git"
    
      27  "vesktop.desktop::https://aur.archlinux.org/cgit/aur.git/plain/vesktop.desktop?h=vesktop-git"
    
      28  "vesktop.sh::https://aur.archlinux.org/cgit/aur.git/plain/vesktop.sh?h=vesktop-git"
    
      29)
    
      30
    
      31sha256sums=('SKIP'
    
      32            '455c00b862aa0a7e18ca8e23d65d5c5ee4506cdfb15f1bf6f622cce39827de46'
    
      33            '506c246328af639d6f6a3e52215c7b34af2a6df11d195de6f57a8bbee750cce9')
    
      34
    
      35options=(!debug)
    
      36
    
      37pkgver() {
    
      38  cd "$_pkgname" || exit
    
      39  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      40}
    
      41
    
      42
    
      43build() {
    
      44  cd "$srcdir/$_pkgname" || exit
    
      45
    
      46  # Change branch
    
      47  git checkout global-shortcuts
    
      48
    
      49  pnpm i --frozen-lockfile
    
      50
    
      51  # Extra dependencie
    
      52  pnpm add uiohook-napi --allow-build=uiohook-napi
    
      53
    
      54  pnpm buildLibVesktop
    
      55  pnpm package:dir
    
      56}
    
      57
    
      58package() {
    
      59  cd "$srcdir/$_pkgname" || exit
    
      60
    
      61  # Create necessary directories
    
      62  install -d "$pkgdir/usr/lib/$_pkgname"
    
      63  install -d "$pkgdir/usr/bin"
    
      64
    
      65  cp -R dist/linux-*unpacked/. "$pkgdir/usr/lib/$_pkgname"
    
      66
    
      67  install -Dm644 "../vesktop.desktop" "$pkgdir/usr/share/applications/vesktop.desktop" # Install desktop entry
    
      68  install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE" # Install license
    
      69  install -Dm644 "build/icon.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/$_pkgname.svg" # Install icons
    
      70
    
      71  install -Dm755 "../vesktop.sh" "$pkgdir/usr/bin/$_pkgname" # Start script
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-26 19:17:50	Low	3
2026-09-26 19:15:27	Medium	3