voltius

maintainer ezhkov · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate source tarball and uses npm to install pnpm locally for building; the flagged external package install is part of the build toolchain, not a hidden dependency or malicious payload.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate source tarball and uses npm to install pnpm locally for building; the flagged external package install is part of the build toolchain, not a hidden dependency or malicious payload.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:24 npm install -g pnpm@10.34.5 --prefix "$srcdir/npm-global"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ezhkov <alexcez94@gmail.com>
    
      2pkgname=voltius
    
      3pkgver=0.12.0
    
      4pkgrel=1
    
      5pkgdesc="Local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/VoltiusApp/voltius"
    
      8license=('AGPL3')
    
      9depends=('webkit2gtk-4.1' 'gtk3' 'libappindicator-gtk3' 'librsvg' 'libsecret' 'hicolor-icon-theme')
    
      10makedepends=('rust' 'nodejs' 'npm' 'git' 'appmenu-gtk-module' 'desktop-file-utils')
    
      11options=('!lto')
    
      12source=(
    
      13  "$pkgname-$pkgver.tar.gz::https://github.com/VoltiusApp/voltius/archive/refs/tags/v$pkgver.tar.gz"
    
      14  "$pkgname.desktop"
    
      15)
    
      16sha256sums=('04fcff41481e15ef8a9b0f89890dde1abda3328afb11d0fe84d76a8a9793ca2b'
    
      17            '101c1683674e94e286f06627f76d0422e506afd2579620d202710bd304693f44')
    
      18
    
      19prepare() {
    
      20  cd "voltius-$pkgver"
    
      21  # pnpm isn't in the official repos; install it into a local, writable
    
      22  # prefix rather than relying on `corepack enable` (which tries to write
    
      23  # shims next to the system-wide nodejs install under /usr).
    
      24  npm install -g pnpm@10.34.5 --prefix "$srcdir/npm-global"
    
      25}
    
      26
    
      27build() {
    
      28  cd "voltius-$pkgver"
    
      29  export PATH="$srcdir/npm-global/bin:$PATH"
    
      30  export TAURI_SIGNING_PRIVATE_KEY="aur-build-dummy-key"
    
      31  export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="aur-build-dummy-pass"
    
      32  export NODE_ENV=production
    
      33  pnpm install --frozen-lockfile
    
      34  pnpm tauri build --no-bundle
    
      35}
    
      36
    
      37package() {
    
      38  cd "voltius-$pkgver"
    
      39
    
      40  install -Dm755 target/release/voltius "$pkgdir/usr/bin/voltius"
    
      41  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      42
    
      43  install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      44
    
      45  install -Dm644 src-tauri/icons/32x32.png \
    
      46    "$pkgdir/usr/share/icons/hicolor/32x32/apps/$pkgname.png"
    
      47  install -Dm644 src-tauri/icons/128x128.png \
    
      48    "$pkgdir/usr/share/icons/hicolor/128x128/apps/$pkgname.png"
    
      49  install -Dm644 src-tauri/icons/128x128@2x.png \
    
      50    "$pkgdir/usr/share/icons/hicolor/256x256/apps/$pkgname.png"
    
      51}
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: ezhkov <alexcez94@gmail.com>
 pkgname=voltius
-pkgver=0.9.2
+pkgver=0.12.0
 pkgrel=1
 pkgdesc="Local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required"
 arch=('x86_64' 'aarch64')
@@ -13,8 +13,8 @@
   "$pkgname-$pkgver.tar.gz::https://github.com/VoltiusApp/voltius/archive/refs/tags/v$pkgver.tar.gz"
   "$pkgname.desktop"
 )
-sha256sums=('b6fe3fc90513043c987262873b0dc7a4cc57976645425542ee4d8a371ee26259'
-            'SKIP')
+sha256sums=('04fcff41481e15ef8a9b0f89890dde1abda3328afb11d0fe84d76a8a9793ca2b'
+            '101c1683674e94e286f06627f76d0422e506afd2579620d202710bd304693f44')
 
 prepare() {
   cd "voltius-$pkgver"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 21:22:00	MEDIUM	2
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 21:12:02	MEDIUM	2
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3