vnstat-client-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-10-05 23:40:58.404909
View on AUR
Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:132 yarn add -D webpack-cli
Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:140 npx next build
  • PKGBUILD:141 npx next export -o ../renderer-out

PKGBUILD

3 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=vnstat-client-git
3_pkgname='vnStat Client'
4pkgver=5.0.0.beta.r7.g484b1d2
5_electronversion=19
6_nodeversion=16
7pkgrel=1
8pkgdesc="GUI Client for vnStat Network Monitor for Linux or GNU/Linux."
9arch=(
10 'aarch64'
11 'x86_64'
12)
13url="https://hulxv.github.io/vnstat-client/"
14_ghurl="https://github.com/Hulxv/vnstat-client"
15license=("GPL-2.0-only")
16conflicts=("${pkgname%-git}")
17provides=("${pkgname%-git}=${pkgver%.r*}")
18depends=(
19 "electron${_electronversion}"
20 'vnstat>=2.8'
21)
22makedepends=(
23 'npm'
24 'yarn'
25 'git'
26 'nvm'
27 'jq'
28)
29install="${pkgname%-git}.install"
30source=(
31 "${pkgname%-git}.git::git+${_ghurl}.git"
32 "${pkgname%-git}.desktop"
33 "${pkgname%-git}.sh"
34)
35sha256sums=('SKIP'
36 '85b4730f2d706583b4e0f8bf214277e7032b2918de7a06a3e5f4258836d1f52c'
37 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
38_get_project_dir() {
39 local d
40 while IFS= read -r d; do
41 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
42 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
43}
44pkgver() {
45 cd "$(_get_project_dir)"
46 set -o pipefail
47 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
48 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
49}
50_ensure_local_nvm() {
51 local NVM_DIR="${srcdir}/.nvm"
52 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
53 nvm install "${_nodeversion}"
54 nvm use "${_nodeversion}"
55}
56_get_app_dir() {
57 find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
58}
59_get_electron_version() {
60 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
61 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
62 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
63 [[ -z "${_elec_ver}" ]] && return 1
64 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
65}
66_set_build_env() {
67 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
68 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
69 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
70 export ELECTRON_BUILDER_OFFLINE=true
71 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
72 export HOME="${srcdir}/.home"
73 export XDG_CACHE_HOME="${HOME}/.cache"
74 export XDG_CONFIG_HOME="${HOME}/.config"
75 export XDG_DATA_HOME="${HOME}/.local/share"
76 export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
77 export YARN_NETWORK_CONCURRENCY=32
78 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
79 export COREPACK_HOME="${HOME}/.corepack"
80 export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
81 local _yarnver _yarnmajor=0
82 _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
83 _yarnmajor="${_yarnver%%.*}"
84 _yarnmajor="${_yarnmajor:-0}"
85 if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
86 export XDG_STATE_HOME="${HOME}/.local/state"
87 export YARN_ENABLE_GLOBAL_CACHE=false
88 export YARN_ENABLE_MIRROR=false
89 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
90 export YARN_NODE_LINKER=node-modules
91 export YARN_NM_MODE=hardlinks-local
92 export YARN_ENABLE_TELEMETRY=false
93 export YARN_ENABLE_SCRIPTS=true
94 export YARN_HTTP_TIMEOUT=600000
95 export YARN_HTTP_RETRY=5
96 export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
97 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}"
98 else
99 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
100 export YARN_LINK_FOLDER="${HOME}/.yarn/link"
101 export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
102 export YARN_NETWORK_TIMEOUT=600000
103 export YARN_CHILD_CONCURRENCY="$(nproc)"
104 export YARN_FROZEN_LOCKFILE=true
105 export YARN_IGNORE_ENGINES=true
106 export YARN_PRODUCTION=false
107 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
108 fi
109 local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
110 _reg="${_reg%/}"
111 if [[ -f .yarnrc ]]; then
112 sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
113 fi
114 if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
115 sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
116 fi
117}
118prepare() {
119 cd "$(_get_project_dir)"
120 _get_electron_version
121 sed -i -e "
122 s/@electronversion@/${_electronversion}/g
123 s/@appname@/${pkgname%-git}/g
124 s/@runname@/app.asar/g
125 s/@cfgdirname@/${_pkgname}/g
126 " "${srcdir}/${pkgname%-git}.sh"
127 _ensure_local_nvm
128 _set_build_env
129 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
130 export NODE_ENV=development
131 yarn install
132 yarn add -D webpack-cli
133}
134build() {
135 cd "$(_get_project_dir)"
136 _ensure_local_nvm
137 _set_build_env
138 export NODE_ENV=production
139 cd renderer
140 npx next build
141 npx next export -o ../renderer-out
142 cd ..
143 node node_modules/nextron/bin/webpack.config.js
144 cp -a renderer-out/* app/
145 rm -rf renderer-out
146 yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
147}
148package() {
149 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
150 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
151 local _app_dir="$(_get_app_dir)"
152 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
153 local _src="$(_get_project_dir)"
154 install -Dm644 "${_src}/resources/icons/512x512.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname%-git}.png"
155 install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
156 install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
157}
158

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-10-05 23:40
@@ -5,7 +5,7 @@
_electronversion=19
_nodeversion=16
pkgrel=1
-pkgdesc="GUI Client for vnStat Network Monitor for Linux or GNU/Linux.(Use system-wide electron)"
+pkgdesc="GUI Client for vnStat Network Monitor for Linux or GNU/Linux."
arch=(
'aarch64'
'x86_64'
@@ -24,7 +24,7 @@
'yarn'
'git'
'nvm'
- 'curl'
+ 'jq'
)
install="${pkgname%-git}.install"
source=(
@@ -34,9 +34,15 @@
)
sha256sums=('SKIP'
'85b4730f2d706583b4e0f8bf214277e7032b2918de7a06a3e5f4258836d1f52c'
- '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
@@ -47,49 +53,106 @@
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
+_get_app_dir() {
+ find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
+}
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+}
+_set_build_env() {
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
+ export YARN_NETWORK_CONCURRENCY=32
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
+ local _yarnver _yarnmajor=0
+ _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
+ _yarnmajor="${_yarnver%%.*}"
+ _yarnmajor="${_yarnmajor:-0}"
+ if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export YARN_ENABLE_GLOBAL_CACHE=false
+ export YARN_ENABLE_MIRROR=false
+ export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
+ export YARN_NODE_LINKER=node-modules
+ export YARN_NM_MODE=hardlinks-local
+ export YARN_ENABLE_TELEMETRY=false
+ export YARN_ENABLE_SCRIPTS=true
+ export YARN_HTTP_TIMEOUT=600000
+ export YARN_HTTP_RETRY=5
+ export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}"
+ else
+ export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
+ export YARN_LINK_FOLDER="${HOME}/.yarn/link"
+ export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
+ export YARN_NETWORK_TIMEOUT=600000
+ export YARN_CHILD_CONCURRENCY="$(nproc)"
+ export YARN_FROZEN_LOCKFILE=true
+ export YARN_IGNORE_ENGINES=true
+ export YARN_PRODUCTION=false
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
+ fi
+ local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
+ _reg="${_reg%/}"
+ if [[ -f .yarnrc ]]; then
+ sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
+ fi
+ if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
+ sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
+ fi
+}
prepare() {
+ cd "$(_get_project_dir)"
+ _get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
s/@runname@/app.asar/g
s/@cfgdirname@/${_pkgname}/g
- s/@options@//g
" "${srcdir}/${pkgname%-git}.sh"
_ensure_local_nvm
- gendesk -q -f -n --pkgname="${pkgname%-git}" --pkgdesc="${pkgdesc}" --categories="Network" --name="${_pkgname}" --exec="${pkgname%-git} %U"
- cd "${srcdir}/${pkgname%-git}.git"
- #export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- HOME="${srcdir}/.electron-gyp"
- mkdir -p "${srcdir}/.electron-gyp"
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- echo -e '\n'
- echo 'registry "https://registry.npmmirror.com"'
- echo 'electron_mirror "https://registry.npmmirror.com/-/binary/electron/"'
- echo 'electron_builder_binaries_mirror "https://registry.npmmirror.com/-/binary/electron-builder-binaries/"'
- echo "cacheFolder "${srcdir}"/.yarn/cache"
- echo "pluginsFolder "${srcdir}"/.yarn/plugins"
- echo "globalFolder "${srcdir}"/.yarn/global"
- echo 'useHardlinks true'
- #echo 'buildFromSource true'
- echo 'linkWorkspacePackages true'
- echo 'fetchRetries 3'
- echo 'fetchRetryTimeout 10000'
- } >> .yarnrc
- find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g" {} +
- fi
- NODE_ENV=development yarn install --cache-folder "${srcdir}/.yarn_cache"
+ _set_build_env
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ export NODE_ENV=development
+ yarn install
+ yarn add -D webpack-cli
}
build() {
- cd "${srcdir}/${pkgname%-git}.git"
- local electronDist="/usr/lib/electron${_electronversion}"
- NODE_ENV=production yarn run build
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
+ _set_build_env
+ export NODE_ENV=production
+ cd renderer
+ npx next build
+ npx next export -o ../renderer-out
+ cd ..
+ node node_modules/nextron/bin/webpack.config.js
+ cp -a renderer-out/* app/
+ rm -rf renderer-out
+ yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/resources/icons/512x512.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
+ install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
+ local _app_dir="$(_get_app_dir)"
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ local _src="$(_get_project_dir)"
+ install -Dm644 "${_src}/resources/icons/512x512.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname%-git}.png"
install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-10-05 23:40:58 Medium 2
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion