vscodium-electron

LOW
maintainer HurricanePootis 12 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The flagged pattern involves using npm install in the build process, but this occurs within the context of building the official VSCodium source from a trusted git repository, which is a normal part of the project's build workflow and does not involve installing unreviewed external packages at runtime.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves using npm install in the build process, but this occurs within the context of building the official VSCodium source from a trusted git repository, which is a normal part of the project's build workflow and does not involve installing unreviewed external packages at runtime.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:117 npm install --global node-gyp

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Richardn <rniu5 at jh dot edu>
2# Contributor: HurricanePootis <hurricanepootis@protonmail.com>
3# Contributor: Łukasz Mariański <lmarianski at protonmail dot com>
4
5_pkgname=vscodium
6_electron=electron42
7_nodejs="24.18.0"
8
9pkgname=${_pkgname}-electron
10pkgver=1.135.06055
11pkgrel=1
12pkgdesc="VS Code without MS branding/telemetry/licensing. - System-wide Electron edition"
13arch=('x86_64' 'aarch64' 'armv7h')
14url="https://github.com/VSCodium/vscodium"
15license=('MIT')
16options=(!strip !debug)
17depends=("$_electron" 'libsecret' 'libx11' 'libxkbfile' 'ripgrep' 'nodejs' 'python-fonttools' 'python' 'perl' 'webkit2gtk-4.1' 'util-linux-libs' 'glibc' 'dbus' 'gtk3' 'curl' 'libsoup3' 'openssl' 'glib2' 'libgcc' 'libstdc++' 'bash')
18optdepends=(
19 'gvfs: For move to trash functionality'
20 'libdbusmenu-glib: For KDE global menu'
21)
22makedepends=('git' 'python' 'nvm' 'jq' 'cargo-nightly')
23provides=(
24 'codium'
25 'vscodium'
26)
27conflicts=(
28 'codium'
29 'vscodium'
30 'vscodium-bin'
31 'vscodium-git'
32)
33source=(
34 "git+https://github.com/VSCodium/vscodium.git#tag=${pkgver}"
35 "vscodium-electron.patch"
36 "${_pkgname}.sh"
37 "${_pkgname}.js"
38 "${_pkgname}.desktop"
39 "${_pkgname}-uri-handler.desktop"
40)
41sha256sums=('0e4a91130b1b1e631830f0156e0844105cb4356505ed23f0b758e368535361c5'
42 'fafa705e51ed4d3044ab8fa2d7970efec8d0046883ebef1b86ebcef3394fa22d'
43 '617591ac74e2ef1ab30425895a79be5580db3280e7e44cee56a7a809637d438f'
44 '28a271ba5b2e50b11259abd794ad2ab083612c78bee2d617bb5a8702932c8f44'
45 '3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e'
46 '6eef345b65bf2679c928c763529540435ab9c6e1836917319810a7a2d484ae1b')
47
48# Even though we don't officially support other archs, let's
49# allow the user to use this PKGBUILD to compile the package
50# for his architecture
51case "$CARCH" in
52 i686)
53 _vscode_arch=ia32
54 ;;
55 x86_64)
56 _vscode_arch=x64
57 ;;
58 armv7h)
59 _vscode_arch=arm
60 ;;
61 *)
62 # Needed for mksrcinfo
63 _vscode_arch=DUMMY
64 ;;
65esac
66
67shopt -s extglob
68
69_ensure_local_nvm() {
70 # let's be sure we are starting clean
71 which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
72 # Use non-hidden nvm folder
73 export NVM_DIR="${srcdir}/nvm"
74
75 # The init script returns 3 if version specified
76 # in ./.nvrc is not (yet) installed in $NVM_DIR
77 # but nvm itself still gets loaded ok
78 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
79}
80
81prepare() {
82 # Abort early if the user does not have the selected electron version installed
83 if ! which $_electron; then
84 echo "Selected electron missing from system. Modify PKGBUILD and retry."
85 exit 1
86 fi
87
88 # Point to system electron in launcher scripts
89 # Do not use inplace sed so that user could change electron version in rebuilds
90 sed "s/@ELECTRON@/${_electron}/" "$srcdir/vscodium.sh" > "$srcdir/vscodium-electron.sh"
91 sed "s/@ELECTRON@/${_electron}/" "$srcdir/vscodium.js" > "$srcdir/vscodium-electron.js"
92
93 cd "$srcdir/vscodium"
94
95 # Remove old build
96 if [ -d vscode ]; then
97 rm -rf vscode VSCode*
98 fi
99
100 # Mangle original vscodium build script to build against system electron
101 patch -u build.sh -i $srcdir/vscodium-electron.patch
102}
103
104build() {
105 export SHOULD_BUILD="yes"
106 export SHOULD_BUILD_REH="no"
107 export CI_BUILD="no"
108 export OS_NAME="linux"
109 export VSCODE_ARCH="${_vscode_arch}"
110 export VSCODE_QUALITY="stable"
111 export RELEASE_VERSION="${pkgver}"
112 export DISABLE_UPDATE="yes"
113 export HOME="${srcdir}"
114 _ensure_local_nvm
115 nvm install "${_nodejs}"
116 nvm use "${_nodejs}"
117 npm install --global node-gyp
118
119 cd "$srcdir/vscodium"
120
121 # the app will be updated with pacman
122 export DISABLE_UPDATE="yes"
123
124 # https://github.com/nodejs/node/issues/51555
125 export DISABLE_V8_COMPILE_CACHE=1
126
127 rustup default stable
128 export CARGO_TARGET_DIR=${srcdir}/${_pkgname}/vscode/cli/target
129
130 . dev/build.sh
131}
132
133package() {
134 # Reference: https://aur.archlinux.org/packages/vscodium
135 install -d -m755 ${pkgdir}/usr/bin
136 install -d -m755 ${pkgdir}/usr/share/{${_pkgname},applications,pixmaps}
137 install -d -m755 ${pkgdir}/usr/share/licenses/${_pkgname}
138
139 # vscodium-electron modification: put resource files and vscodium.js under /usr/lib/
140 install -dm755 "${pkgdir}/usr/lib/${_pkgname}"
141
142 # vscodium-electron modification: Only install licenses, files and shell completions under resources/
143 install -Dm644 "${srcdir}/${_pkgname}/VSCode-linux-${_vscode_arch}/resources/app/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${_pkgname}/"
144 install -Dm644 "${srcdir}/${_pkgname}/VSCode-linux-${_vscode_arch}/resources/app/ThirdPartyNotices.txt" -t "${pkgdir}/usr/share/licenses/${_pkgname}/"
145 cp -r --no-preserve=ownership --preserve=mode "${srcdir}/${_pkgname}"/VSCode-linux-${_vscode_arch}/resources/app/!(LICENSE.txt|ThirdPartyNotices.txt) "$pkgdir/usr/lib/${_pkgname}/"
146 cp -r --no-preserve=ownership --preserve=mode "${srcdir}/${_pkgname}"/VSCode-linux-${_vscode_arch}/resources/completions "$pkgdir/usr/lib/${_pkgname}/"
147
148 # vscodium-electron modification: Use custom launcher scripts
149 install -Dm755 "${srcdir}/vscodium-electron.sh" "${pkgdir}/usr/bin/${_pkgname}"
150 install -Dm755 "${srcdir}/vscodium-electron.js" "${pkgdir}/usr/lib/${_pkgname}/vscodium.js"
151 ln -s "/usr/bin/${_pkgname}" "${pkgdir}/usr/bin/codium"
152
153 # vscodium-electron modification: We handle Wayland at vscodium.sh level
154 install -D -m644 ${_pkgname}.desktop ${pkgdir}/usr/share/applications/${_pkgname}.desktop
155 install -D -m644 ${_pkgname}-uri-handler.desktop ${pkgdir}/usr/share/applications/${_pkgname}-uri-handler.desktop
156 install -D -m644 "${srcdir}/${_pkgname}/VSCode-linux-${_vscode_arch}/resources/app/resources/linux/code.png" ${pkgdir}/usr/share/pixmaps/${_pkgname}.png
157
158 # Symlink shell completions
159 install -d -m755 ${pkgdir}/usr/share/zsh/site-functions
160 install -d -m755 ${pkgdir}/usr/share/bash-completion/completions
161 # vscodium-electrion modification: Shell completion files changed locations
162 ln -s /usr/lib/${_pkgname}/completions/zsh/_codium ${pkgdir}/usr/share/zsh/site-functions
163 ln -s /usr/lib/${_pkgname}/completions/bash/codium ${pkgdir}/usr/share/bash-completion/completions
164
165 # vscodium-electron modification: Replace bundled ripgrep with system ripgrep
166 ln -sf /usr/bin/rg ${pkgdir}/usr/lib/$_pkgname/node_modules.asar.unpacked/@vscode/ripgrep-universal/bin/linux-${_vscode_arch}/rg
167
168 # Install license
169 install -Dm644 "$srcdir/${_pkgname}/LICENSE" "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
170}
171

Changes since previous scan

--- PKGBUILD @ 2026-09-14 00:27
+++ PKGBUILD @ 2026-09-17 00:27
@@ -3,11 +3,11 @@
# Contributor: Łukasz Mariański <lmarianski at protonmail dot com>
_pkgname=vscodium
-_electron=electron41
-_nodejs="22.22.1"
+_electron=electron42
+_nodejs="24.18.0"
pkgname=${_pkgname}-electron
-pkgver=1.121.03429
+pkgver=1.135.06055
pkgrel=1
pkgdesc="VS Code without MS branding/telemetry/licensing. - System-wide Electron edition"
arch=('x86_64' 'aarch64' 'armv7h')
@@ -38,8 +38,8 @@
"${_pkgname}.desktop"
"${_pkgname}-uri-handler.desktop"
)
-sha256sums=('6dfc0ebb833825ef9594bab70078453623a5c6d978303965dcb81d42fd43c8b0'
- 'da6f1b1e668991227584c9a897211cbf098296ea1421ae80b7f67f7e52fb4b6b'
+sha256sums=('0e4a91130b1b1e631830f0156e0844105cb4356505ed23f0b758e368535361c5'
+ 'fafa705e51ed4d3044ab8fa2d7970efec8d0046883ebef1b86ebcef3394fa22d'
'617591ac74e2ef1ab30425895a79be5580db3280e7e44cee56a7a809637d438f'
'28a271ba5b2e50b11259abd794ad2ab083612c78bee2d617bb5a8702932c8f44'
'3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e'
@@ -163,7 +163,7 @@
ln -s /usr/lib/${_pkgname}/completions/bash/codium ${pkgdir}/usr/share/bash-completion/completions
# vscodium-electron modification: Replace bundled ripgrep with system ripgrep
- ln -sf /usr/bin/rg ${pkgdir}/usr/lib/$_pkgname/node_modules/@vscode/ripgrep/bin/rg
+ ln -sf /usr/bin/rg ${pkgdir}/usr/lib/$_pkgname/node_modules.asar.unpacked/@vscode/ripgrep-universal/bin/linux-${_vscode_arch}/rg
# Install license
install -Dm644 "$srcdir/${_pkgname}/LICENSE" "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 23:18:17 Medium 1
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion