vutronmusic

LOW

maintainer zxp19821005 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The yarn install is part of building the project from its own source (git checkout), uses locked mirrors for reliability in China, and depends on system-wide electron; no untrusted external code is silently installed.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The yarn install is part of building the project from its own source (git checkout), uses locked mirrors for reliability in China, and depends on system-wide electron; no untrusted external code is silently installed.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:81 NODE_ENV=development yarn add -D node-addon-api

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=vutronmusic
    
      3_pkgname=VutronMusic
    
      4pkgver=3.2.0
    
      5_electronversion=37
    
      6_nodeversion=22
    
      7pkgrel=1
    
      8pkgdesc="A high-quality third-party NetEase Cloud Music player that supports local music playback, offline playlists, and desktop lyrics.(Use system-wide electron)高颜值的第三方网易云播放器，支持本地音乐播放、离线歌单、桌面歌词、Touch Bar歌词、Mac状态栏歌词显示、Linux-gnome桌面状态栏歌词显示."
    
      9arch=('any')
    
      10url="https://github.com/stark81/VutronMusic"
    
      11license=('MIT')
    
      12depends=(
    
  "electron${_electronversion}"
    
  'libvips'
    
      15)
    
      16makedepends=(
    
  'npm'
    
  'nvm'
    
  'curl'
    
  'gendesk'
    
  'yarn'
    
  'git'
    
  'jq'
    
      24)
    
      25source=(
    
  "${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}"
    
  "${pkgname}.sh"
    
      28)
    
      29sha256sums=('835e861631249c07e2bd16dd8cfb0c0683cad47d7485317789d67e06db411d2c'
    
          '31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
    
      31_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      36}
    
      37_get_electron_version() {
    
  _elec_ver=$(jq -r '.devDependencies["electron"] // .dependencies["electron"]' "${srcdir}/${pkgname}-${pkgver}/package.json" | tr -d '^')
    
  _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
    
  echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
    
      41}
    
      42prepare() {
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  _get_electron_version
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${_pkgname}/g
    
      s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
    
  " "${srcdir}/${pkgname}.sh"
    
  gendesk -q -f -n \
    
      --pkgname="${pkgname}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="AudioVideo" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname} %U"
    
  export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  local HOME="${srcdir}/.electron-gyp"
    
  mkdir -p "${srcdir}/.electron-gyp"
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      {
    
          export YARN_REGISTRY="https://registry.npmmirror.com"
    
          export ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
    
          export ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
    
          export YARN_CACHE_FOLDER="${srcdir}/.yarn/cache"
    
          export YARN_PLUGINS_FOLDER="${srcdir}/.yarn/plugins"
    
          export YARN_GLOBAL_FOLDER="${srcdir}/.yarn/global"
    
          export YARN_USE_HARDLINKS=true
    
          # export YARN_BUILD_FROM_SOURCE=true
    
          export YARN_LINK_WORKSPACE_PACKAGES=true
    
          export YARN_FETCH_RETRIES=3
    
          export YARN_FETCH_RETRY_TIMEOUT=10000
    
          export YARN_NETWORK_CONCURRENCY=32
    
      }
    
      find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g" {} +
    
  fi
    
  _ensure_local_nvm
    
  sed -i "s/\/\${version}//g" buildAssets/builder/config.js
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  NODE_ENV=development    yarn add -D node-addon-api 
    
  NODE_ENV=development    yarn install --cache-folder "${srcdir}/.yarn_cache"
    
      83}
    
      84build() {
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  _ensure_local_nvm
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  local electronDist="/usr/lib/electron${_electronversion}"
    
  NODE_ENV=production     yarn run build:pre
    
  NODE_ENV=production     yarn electron-builder --linux dir -c.electronDist="${electronDist}" --config=buildAssets/builder/config.js
    
  rm -rf "${srcdir}/${pkgname}-${pkgver}/release/linux-"*/resources/app.asar.unpacked/node_modules/font-list/libs/{darwin,win32}
    
      92}
    
      93package() {
    
  install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
    
find "${srcdir}/${pkgname}-${pkgver}/release/linux-"*"/resources" -maxdepth 1 -type f -exec install -Dm644 -t "${pkgdir}/usr/lib/${pkgname}" {} +
    
  if find "${srcdir}/${pkgname}-${pkgver}/release/linux-"*"/resources" -mindepth 1 -maxdepth 1 -type d | read; then
    
      for _subdir in "${srcdir}/${pkgname}-${pkgver}/release/linux-"*"/resources/"*; do
    
          if [ -d "${_subdir}" ]; then
    
              cp -Pr --no-preserve=ownership "${_subdir}" "${pkgdir}/usr/lib/${pkgname}"
    
          fi
    
      done
    
  fi
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/buildAssets/icons/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      107}
    
      108

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2