voltius
LOW
maintainer ezhkov
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npm install in prepare() is for pnpm, a build tool required to build the project's own source from the verified GitHub tarball; it is not an undeclared external dependency being executed or installed into the package.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install in prepare() is for pnpm, a build tool required to build the project's own source from the verified GitHub tarball; it is not an undeclared external dependency being executed or installed into the package.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:24
npm install -g pnpm@10.34.5 --prefix "$srcdir/npm-global"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: ezhkov <alexcez94@gmail.com>
2
pkgname=voltius
3
pkgver=0.37.0
4
pkgrel=1
5
pkgdesc="Local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required"
6
arch=('x86_64' 'aarch64')
7
url="https://github.com/VoltiusApp/voltius"
8
license=('AGPL3')
9
depends=('webkit2gtk-4.1' 'gtk3' 'libappindicator-gtk3' 'librsvg' 'libsecret' 'hicolor-icon-theme')
10
makedepends=('rust' 'nodejs' 'npm' 'git' 'appmenu-gtk-module' 'desktop-file-utils')
11
options=('!lto')
12
source=(
13
"$pkgname-$pkgver.tar.gz::https://github.com/VoltiusApp/voltius/archive/refs/tags/v$pkgver.tar.gz"
14
"$pkgname.desktop"
15
)
16
sha256sums=('e539d1825cf705c009ac29f73d6eef3733467c07bcbed735985c325d25029613'
17
'101c1683674e94e286f06627f76d0422e506afd2579620d202710bd304693f44')
18
19
prepare() {
20
cd "voltius-$pkgver"
21
# pnpm isn't in the official repos; install it into a local, writable
22
# prefix rather than relying on `corepack enable` (which tries to write
23
# shims next to the system-wide nodejs install under /usr).
24
npm install -g pnpm@10.34.5 --prefix "$srcdir/npm-global"
25
}
26
27
build() {
28
export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=/usr/bin/gcc
29
cd "voltius-$pkgver"
30
export PATH="$srcdir/npm-global/bin:$PATH"
31
export TAURI_SIGNING_PRIVATE_KEY="aur-build-dummy-key"
32
export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="aur-build-dummy-pass"
33
export NODE_ENV=production
34
pnpm install --frozen-lockfile
35
pnpm tauri build --no-bundle
36
}
37
38
package() {
39
cd "voltius-$pkgver"
40
41
install -Dm755 target/release/voltius "$pkgdir/usr/bin/voltius"
42
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
43
44
install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
45
46
install -Dm644 src-tauri/icons/32x32.png \
47
"$pkgdir/usr/share/icons/hicolor/32x32/apps/$pkgname.png"
48
install -Dm644 src-tauri/icons/128x128.png \
49
"$pkgdir/usr/share/icons/hicolor/128x128/apps/$pkgname.png"
50
install -Dm644 src-tauri/icons/128x128@2x.png \
51
"$pkgdir/usr/share/icons/hicolor/256x256/apps/$pkgname.png"
52
}
53
Changes since previous scan
--- PKGBUILD @ 2026-09-16 00:03+++ PKGBUILD @ 2026-09-17 00:27@@ -1,6 +1,6 @@ # Maintainer: ezhkov <alexcez94@gmail.com> pkgname=voltius-pkgver=0.34.5+pkgver=0.37.0 pkgrel=1 pkgdesc="Local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required" arch=('x86_64' 'aarch64')@@ -13,7 +13,7 @@ "$pkgname-$pkgver.tar.gz::https://github.com/VoltiusApp/voltius/archive/refs/tags/v$pkgver.tar.gz" "$pkgname.desktop" )-sha256sums=('52c6cedfe3a81636061e7ba1d29543b15307355ec2e3189974699d62e044f207'+sha256sums=('e539d1825cf705c009ac29f73d6eef3733467c07bcbed735985c325d25029613' '101c1683674e94e286f06627f76d0422e506afd2579620d202710bd304693f44') prepare() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 21:23:45 | Medium | 1 |
| 2026-09-16 17:23:26 | Medium | 1 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 09:19:41 | Medium | 1 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 19:17:46 | Medium | 1 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 15:14:52 | Medium | 1 |
| 2026-09-13 11:14:35 | Medium | 1 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 21:12:39 | Medium | 1 |
| 2026-09-12 15:12:25 | Medium | 1 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 09:22:22 | Medium | 1 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 17:21:08 | Medium | 1 |
| 2026-09-10 15:20:39 | Medium | 1 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |