vscodium-electron

LOW

maintainer HurricanePootis 12 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The npm install occurs in a controlled build environment using the project's own source code and declared dependencies; it does not install arbitrary external packages or execute untrusted remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npm install occurs in a controlled build environment using the project's own source code and declared dependencies; it does not install arbitrary external packages or execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:117 npm install --global node-gyp

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Richardn <rniu5 at jh dot edu>
    
      2# Contributor: HurricanePootis <hurricanepootis@protonmail.com>
    
      3# Contributor: Łukasz Mariański <lmarianski at protonmail dot com>
    
      4
    
      5_pkgname=vscodium
    
      6_electron=electron42
    
      7_nodejs="24.18.0"
    
      8
    
      9pkgname=${_pkgname}-electron
    
      10pkgver=1.143.17183
    
      11pkgrel=1
    
      12pkgdesc="VS Code without MS branding/telemetry/licensing. - System-wide Electron edition"
    
      13arch=('x86_64' 'aarch64' 'armv7h')
    
      14url="https://github.com/VSCodium/vscodium"
    
      15license=('MIT')
    
      16options=(!strip !debug)
    
      17depends=("$_electron" 'libsecret' 'libx11' 'libxkbfile' 'ripgrep' 'nodejs' 'python-fonttools' 'python' 'perl' 'webkit2gtk-4.1' 'util-linux-libs' 'glibc' 'dbus' 'gtk3' 'curl' 'libsoup3' 'openssl' 'glib2' 'libgcc' 'libstdc++' 'bash')
    
      18optdepends=(
    
      19	'gvfs: For move to trash functionality'
    
      20	'libdbusmenu-glib: For KDE global menu'
    
      21)
    
      22makedepends=('git' 'python' 'nvm' 'jq' 'cargo-nightly')
    
      23provides=(
    
      24	'codium'
    
      25	'vscodium'
    
      26)
    
      27conflicts=(
    
      28	'codium'
    
      29	'vscodium'
    
      30	'vscodium-bin'
    
      31	'vscodium-git'
    
      32)
    
      33source=(
    
      34	"git+https://github.com/VSCodium/vscodium.git#tag=${pkgver}"
    
      35	"vscodium-electron.patch"
    
      36	"${_pkgname}.sh"
    
      37	"${_pkgname}.js"
    
      38	"${_pkgname}.desktop"
    
      39	"${_pkgname}-uri-handler.desktop"
    
      40)
    
      41sha256sums=('e65d5fa055c12431df9c3fcfa8ae5c172a510421074800c9e9db367f19299adc'
    
      42            'fafa705e51ed4d3044ab8fa2d7970efec8d0046883ebef1b86ebcef3394fa22d'
    
      43            '617591ac74e2ef1ab30425895a79be5580db3280e7e44cee56a7a809637d438f'
    
      44            '28a271ba5b2e50b11259abd794ad2ab083612c78bee2d617bb5a8702932c8f44'
    
      45            '3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e'
    
      46            '6eef345b65bf2679c928c763529540435ab9c6e1836917319810a7a2d484ae1b')
    
      47
    
      48# Even though we don't officially support other archs, let's
    
      49# allow the user to use this PKGBUILD to compile the package
    
      50# for his architecture
    
      51case "$CARCH" in
    
      52  i686)
    
      53    _vscode_arch=ia32
    
      54    ;;
    
      55  x86_64)
    
      56    _vscode_arch=x64
    
      57    ;;
    
      58  armv7h)
    
      59    _vscode_arch=arm
    
      60    ;;
    
      61  *)
    
      62    # Needed for mksrcinfo
    
      63    _vscode_arch=DUMMY
    
      64    ;;
    
      65esac
    
      66
    
      67shopt -s extglob
    
      68
    
      69_ensure_local_nvm() {
    
      70	# let's be sure we are starting clean
    
      71	which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      72	# Use non-hidden nvm folder
    
      73	export NVM_DIR="${srcdir}/nvm"
    
      74
    
      75	# The init script returns 3 if version specified
    
      76	# in ./.nvrc is not (yet) installed in $NVM_DIR
    
      77	# but nvm itself still gets loaded ok
    
      78	source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      79}
    
      80
    
      81prepare() {
    
      82	# Abort early if the user does not have the selected electron version installed
    
      83	if ! which $_electron; then
    
      84		echo "Selected electron missing from system. Modify PKGBUILD and retry."
    
      85		exit 1
    
      86	fi
    
      87
    
      88	# Point to system electron in launcher scripts
    
      89	# Do not use inplace sed so that user could change electron version in rebuilds
    
      90	sed "s/@ELECTRON@/${_electron}/" "$srcdir/vscodium.sh" > "$srcdir/vscodium-electron.sh"
    
      91	sed "s/@ELECTRON@/${_electron}/" "$srcdir/vscodium.js" > "$srcdir/vscodium-electron.js"
    
      92
    
      93	cd "$srcdir/vscodium"
    
      94
    
      95	# Remove old build
    
      96	if [ -d vscode ]; then
    
      97		rm -rf vscode VSCode*
    
      98	fi
    
      99
    
      100	# Mangle original vscodium build script to build against system electron
    
      101	patch -u build.sh -i $srcdir/vscodium-electron.patch
    
      102}
    
      103
    
      104build() {
    
      105	export SHOULD_BUILD="yes"
    
      106	export SHOULD_BUILD_REH="no"
    
      107	export CI_BUILD="no"
    
      108	export OS_NAME="linux"
    
      109	export VSCODE_ARCH="${_vscode_arch}"
    
      110	export VSCODE_QUALITY="stable"
    
      111	export RELEASE_VERSION="${pkgver}"
    
      112	export DISABLE_UPDATE="yes"
    
      113	export HOME="${srcdir}"
    
      114	_ensure_local_nvm
    
      115	nvm install "${_nodejs}"
    
      116	nvm use "${_nodejs}"
    
      117	npm install --global node-gyp
    
      118
    
      119	cd "$srcdir/vscodium"
    
      120
    
      121	# the app will be updated with pacman
    
      122	export DISABLE_UPDATE="yes"
    
      123
    
      124	# https://github.com/nodejs/node/issues/51555
    
      125	export DISABLE_V8_COMPILE_CACHE=1
    
      126
    
      127	rustup default stable
    
      128	export CARGO_TARGET_DIR=${srcdir}/${_pkgname}/vscode/cli/target
    
      129
    
      130	. dev/build.sh
    
      131}
    
      132
    
      133package() {
    
      134	# Reference: https://aur.archlinux.org/packages/vscodium
    
      135	install -d -m755 ${pkgdir}/usr/bin
    
      136	install -d -m755 ${pkgdir}/usr/share/{applications,pixmaps}
    
      137	install -d -m755 ${pkgdir}/usr/share/licenses/${_pkgname}
    
      138
    
      139	# vscodium-electron modification: put resource files and vscodium.js under /usr/lib/
    
      140	install -dm755 "${pkgdir}/usr/lib/${_pkgname}"
    
      141
    
      142	# vscodium-electron modification: Only install licenses, files and shell completions under resources/
    
      143	install -Dm644 "${srcdir}/${_pkgname}/VSCode-linux-${_vscode_arch}/resources/app/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${_pkgname}/"
    
      144	install -Dm644 "${srcdir}/${_pkgname}/VSCode-linux-${_vscode_arch}/resources/app/ThirdPartyNotices.txt" -t "${pkgdir}/usr/share/licenses/${_pkgname}/"
    
      145	cp -r --no-preserve=ownership --preserve=mode "${srcdir}/${_pkgname}"/VSCode-linux-${_vscode_arch}/resources/app/!(LICENSE.txt|ThirdPartyNotices.txt) "$pkgdir/usr/lib/${_pkgname}/"
    
      146	cp -r --no-preserve=ownership --preserve=mode "${srcdir}/${_pkgname}"/VSCode-linux-${_vscode_arch}/resources/completions "$pkgdir/usr/lib/${_pkgname}/"
    
      147
    
      148	# vscodium-electron modification: Use custom launcher scripts
    
      149	install -Dm755 "${srcdir}/vscodium-electron.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      150	install -Dm755 "${srcdir}/vscodium-electron.js" "${pkgdir}/usr/lib/${_pkgname}/vscodium.js"
    
      151	ln -s "/usr/bin/${_pkgname}" "${pkgdir}/usr/bin/codium"
    
      152
    
      153	# vscodium-electron modification: We handle Wayland at vscodium.sh level
    
      154	install -D -m644 ${_pkgname}.desktop ${pkgdir}/usr/share/applications/${_pkgname}.desktop
    
      155	install -D -m644 ${_pkgname}-uri-handler.desktop ${pkgdir}/usr/share/applications/${_pkgname}-uri-handler.desktop
    
      156	install -D -m644 "${srcdir}/${_pkgname}/VSCode-linux-${_vscode_arch}/resources/app/resources/linux/code.png" ${pkgdir}/usr/share/pixmaps/${_pkgname}.png
    
      157
    
      158	# Symlink shell completions
    
      159	install -d -m755 ${pkgdir}/usr/share/zsh/site-functions
    
      160	install -d -m755 ${pkgdir}/usr/share/bash-completion/completions
    
      161	# vscodium-electrion modification: Shell completion files changed locations
    
      162	ln -s /usr/lib/${_pkgname}/completions/zsh/_codium ${pkgdir}/usr/share/zsh/site-functions
    
      163	ln -s /usr/lib/${_pkgname}/completions/bash/codium ${pkgdir}/usr/share/bash-completion/completions
    
      164
    
      165	# vscodium-electron modification: Replace bundled ripgrep with system ripgrep
    
      166	ln -sf /usr/bin/rg ${pkgdir}/usr/lib/$_pkgname/node_modules.asar.unpacked/@vscode/ripgrep-universal/bin/linux-${_vscode_arch}/rg
    
      167
    
      168	# Install license
    
      169	install -Dm644 "$srcdir/${_pkgname}/LICENSE" "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
    
      170
    
      171	# Clean up sourcemaps
    
      172	cd "$pkgdir/usr/lib/vscodium"
    
      173	find . -type f -name *.map -exec rm {} \;
    
      174}
    
      175

Changes since previous scan

--- PKGBUILD @ 2026-10-27 00:23
+++ PKGBUILD @ 2026-11-01 00:21
@@ -7,7 +7,7 @@
 _nodejs="24.18.0"
 
 pkgname=${_pkgname}-electron
-pkgver=1.140.06880
+pkgver=1.143.17183
 pkgrel=1
 pkgdesc="VS Code without MS branding/telemetry/licensing. - System-wide Electron edition"
 arch=('x86_64' 'aarch64' 'armv7h')
@@ -38,7 +38,7 @@
 	"${_pkgname}.desktop"
 	"${_pkgname}-uri-handler.desktop"
 )
-sha256sums=('179acfacb8b0704a49173be09cb98558e149fadda112db067d30f7fb7a547592'
+sha256sums=('e65d5fa055c12431df9c3fcfa8ae5c172a510421074800c9e9db367f19299adc'
             'fafa705e51ed4d3044ab8fa2d7970efec8d0046883ebef1b86ebcef3394fa22d'
             '617591ac74e2ef1ab30425895a79be5580db3280e7e44cee56a7a809637d438f'
             '28a271ba5b2e50b11259abd794ad2ab083612c78bee2d617bb5a8702932c8f44'

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 17:48:24	Medium	1
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 05:21:06	Medium	1
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2