vscodium-electron
maintainer HurricanePootis
· 11 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The npm install occurs during build from a legitimate project source (GitHub) using a declared Node.js version, which is standard for building Node-based applications; the flagged pattern is a false positive as it installs only project dependencies, not arbitrary external code.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install occurs during build from a legitimate project source (GitHub) using a declared Node.js version, which is standard for building Node-based applications; the flagged pattern is a false positive as it installs only project dependencies, not arbitrary external code.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:117
npm install --global node-gyp
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Richardn <rniu5 at jh dot edu>
2
# Contributor: HurricanePootis <hurricanepootis@protonmail.com>
3
# Contributor: Łukasz Mariański <lmarianski at protonmail dot com>
4
5
_pkgname=vscodium
6
_electron=electron41
7
_nodejs="22.22.1"
8
9
pkgname=${_pkgname}-electron
10
pkgver=1.121.03429
11
pkgrel=1
12
pkgdesc="VS Code without MS branding/telemetry/licensing. - System-wide Electron edition"
13
arch=('x86_64' 'aarch64' 'armv7h')
14
url="https://github.com/VSCodium/vscodium"
15
license=('MIT')
16
options=(!strip !debug)
17
depends=("$_electron" 'libsecret' 'libx11' 'libxkbfile' 'ripgrep' 'nodejs' 'python-fonttools' 'python' 'perl' 'webkit2gtk-4.1' 'util-linux-libs' 'glibc' 'dbus' 'gtk3' 'curl' 'libsoup3' 'openssl' 'glib2' 'libgcc' 'libstdc++' 'bash')
18
optdepends=(
19
'gvfs: For move to trash functionality'
20
'libdbusmenu-glib: For KDE global menu'
21
)
22
makedepends=('git' 'python' 'nvm' 'jq' 'cargo-nightly')
23
provides=(
24
'codium'
25
'vscodium'
26
)
27
conflicts=(
28
'codium'
29
'vscodium'
30
'vscodium-bin'
31
'vscodium-git'
32
)
33
source=(
34
"git+https://github.com/VSCodium/vscodium.git#tag=${pkgver}"
35
"vscodium-electron.patch"
36
"${_pkgname}.sh"
37
"${_pkgname}.js"
38
"${_pkgname}.desktop"
39
"${_pkgname}-uri-handler.desktop"
40
)
41
sha256sums=('6dfc0ebb833825ef9594bab70078453623a5c6d978303965dcb81d42fd43c8b0'
42
'da6f1b1e668991227584c9a897211cbf098296ea1421ae80b7f67f7e52fb4b6b'
43
'617591ac74e2ef1ab30425895a79be5580db3280e7e44cee56a7a809637d438f'
44
'28a271ba5b2e50b11259abd794ad2ab083612c78bee2d617bb5a8702932c8f44'
45
'3a5bc109974fcf408855c13965f6d6be0997655c5b359de0bfd19a678c00844e'
46
'6eef345b65bf2679c928c763529540435ab9c6e1836917319810a7a2d484ae1b')
47
48
# Even though we don't officially support other archs, let's
49
# allow the user to use this PKGBUILD to compile the package
50
# for his architecture
51
case "$CARCH" in
52
i686)
53
_vscode_arch=ia32
54
;;
55
x86_64)
56
_vscode_arch=x64
57
;;
58
armv7h)
59
_vscode_arch=arm
60
;;
61
*)
62
# Needed for mksrcinfo
63
_vscode_arch=DUMMY
64
;;
65
esac
66
67
shopt -s extglob
68
69
_ensure_local_nvm() {
70
# let's be sure we are starting clean
71
which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
72
# Use non-hidden nvm folder
73
export NVM_DIR="${srcdir}/nvm"
74
75
# The init script returns 3 if version specified
76
# in ./.nvrc is not (yet) installed in $NVM_DIR
77
# but nvm itself still gets loaded ok
78
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
79
}
80
81
prepare() {
82
# Abort early if the user does not have the selected electron version installed
83
if ! which $_electron; then
84
echo "Selected electron missing from system. Modify PKGBUILD and retry."
85
exit 1
86
fi
87
88
# Point to system electron in launcher scripts
89
# Do not use inplace sed so that user could change electron version in rebuilds
90
sed "s/@ELECTRON@/${_electron}/" "$srcdir/vscodium.sh" > "$srcdir/vscodium-electron.sh"
91
sed "s/@ELECTRON@/${_electron}/" "$srcdir/vscodium.js" > "$srcdir/vscodium-electron.js"
92
93
cd "$srcdir/vscodium"
94
95
# Remove old build
96
if [ -d vscode ]; then
97
rm -rf vscode VSCode*
98
fi
99
100
# Mangle original vscodium build script to build against system electron
101
patch -u build.sh -i $srcdir/vscodium-electron.patch
102
}
103
104
build() {
105
export SHOULD_BUILD="yes"
106
export SHOULD_BUILD_REH="no"
107
export CI_BUILD="no"
108
export OS_NAME="linux"
109
export VSCODE_ARCH="${_vscode_arch}"
110
export VSCODE_QUALITY="stable"
111
export RELEASE_VERSION="${pkgver}"
112
export DISABLE_UPDATE="yes"
113
export HOME="${srcdir}"
114
_ensure_local_nvm
115
nvm install "${_nodejs}"
116
nvm use "${_nodejs}"
117
npm install --global node-gyp
118
119
cd "$srcdir/vscodium"
120
121
# the app will be updated with pacman
122
export DISABLE_UPDATE="yes"
123
124
# https://github.com/nodejs/node/issues/51555
125
export DISABLE_V8_COMPILE_CACHE=1
126
127
rustup default stable
128
export CARGO_TARGET_DIR=${srcdir}/${_pkgname}/vscode/cli/target
129
130
. dev/build.sh
131
}
132
133
package() {
134
# Reference: https://aur.archlinux.org/packages/vscodium
135
install -d -m755 ${pkgdir}/usr/bin
136
install -d -m755 ${pkgdir}/usr/share/{${_pkgname},applications,pixmaps}
137
install -d -m755 ${pkgdir}/usr/share/licenses/${_pkgname}
138
139
# vscodium-electron modification: put resource files and vscodium.js under /usr/lib/
140
install -dm755 "${pkgdir}/usr/lib/${_pkgname}"
141
142
# vscodium-electron modification: Only install licenses, files and shell completions under resources/
143
install -Dm644 "${srcdir}/${_pkgname}/VSCode-linux-${_vscode_arch}/resources/app/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${_pkgname}/"
144
install -Dm644 "${srcdir}/${_pkgname}/VSCode-linux-${_vscode_arch}/resources/app/ThirdPartyNotices.txt" -t "${pkgdir}/usr/share/licenses/${_pkgname}/"
145
cp -r --no-preserve=ownership --preserve=mode "${srcdir}/${_pkgname}"/VSCode-linux-${_vscode_arch}/resources/app/!(LICENSE.txt|ThirdPartyNotices.txt) "$pkgdir/usr/lib/${_pkgname}/"
146
cp -r --no-preserve=ownership --preserve=mode "${srcdir}/${_pkgname}"/VSCode-linux-${_vscode_arch}/resources/completions "$pkgdir/usr/lib/${_pkgname}/"
147
148
# vscodium-electron modification: Use custom launcher scripts
149
install -Dm755 "${srcdir}/vscodium-electron.sh" "${pkgdir}/usr/bin/${_pkgname}"
150
install -Dm755 "${srcdir}/vscodium-electron.js" "${pkgdir}/usr/lib/${_pkgname}/vscodium.js"
151
ln -s "/usr/bin/${_pkgname}" "${pkgdir}/usr/bin/codium"
152
153
# vscodium-electron modification: We handle Wayland at vscodium.sh level
154
install -D -m644 ${_pkgname}.desktop ${pkgdir}/usr/share/applications/${_pkgname}.desktop
155
install -D -m644 ${_pkgname}-uri-handler.desktop ${pkgdir}/usr/share/applications/${_pkgname}-uri-handler.desktop
156
install -D -m644 "${srcdir}/${_pkgname}/VSCode-linux-${_vscode_arch}/resources/app/resources/linux/code.png" ${pkgdir}/usr/share/pixmaps/${_pkgname}.png
157
158
# Symlink shell completions
159
install -d -m755 ${pkgdir}/usr/share/zsh/site-functions
160
install -d -m755 ${pkgdir}/usr/share/bash-completion/completions
161
# vscodium-electrion modification: Shell completion files changed locations
162
ln -s /usr/lib/${_pkgname}/completions/zsh/_codium ${pkgdir}/usr/share/zsh/site-functions
163
ln -s /usr/lib/${_pkgname}/completions/bash/codium ${pkgdir}/usr/share/bash-completion/completions
164
165
# vscodium-electron modification: Replace bundled ripgrep with system ripgrep
166
ln -sf /usr/bin/rg ${pkgdir}/usr/lib/$_pkgname/node_modules/@vscode/ripgrep/bin/rg
167
168
# Install license
169
install -Dm644 "$srcdir/${_pkgname}/LICENSE" "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
170
}
171
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |