wai-chat-desktop

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The npm install runs in the build environment but uses the project's own package.json and lockfile; the only external package addition is a declared dev plugin for local Electron integration, which is part of the build process and not executed at runtime.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npm install runs in the build environment but uses the project's own package.json and lockfile; the only external package addition is a declared dev plugin for local Electron integration, which is part of the build process and not executed at runtime.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:73 NODE_ENV=development npm add -D @electron-forge/plugin-local-electron

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=wai-chat-desktop
3_pkgname='Wai Chat'
4pkgver=1.1.2
5_electronversion=24
6_nodeversion=18
7pkgrel=11
8pkgdesc="An electron project for chatgpt wai chat bot.(Use system-wide electron)"
9arch=('any')
10url="https://github.com/ptp-build/wai-chat-desktop"
11license=('GPL-3.0-only')
12conflicts=("${pkgname}")
13depends=(
14 "electron${_electronversion}"
15)
16makedepends=(
17 'npm'
18 'gendesk'
19 'nvm'
20 'curl'
21 'git'
22)
23options=(
24 'emptydirs'
25)
26source=(
27 "${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}"
28 "${pkgname}.sh"
29)
30sha256sums=('df5d501a594b216472c5dd9130bceb6474370af339db54443a0a1c4524e40d65'
31 '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
32_ensure_local_nvm() {
33 local NVM_DIR="${srcdir}/.nvm"
34 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
35 nvm install "${_nodeversion}"
36 nvm use "${_nodeversion}"
37}
38prepare() {
39 cd "${srcdir}/${pkgname}-${pkgver}"
40 sed -i -e "
41 s/@electronversion@/${_electronversion}/g
42 s/@appname@/${pkgname}/g
43 s/@runname@/app/g
44 s/@cfgdirname@/${_pkgname}/g
45 s/@options@//g
46 " "${srcdir}/${pkgname}.sh"
47 _ensure_local_nvm
48 gendesk -q -f -n \
49 --pkgname="${pkgname}" \
50 --pkgdesc="${pkgdesc}" \
51 --categories="Utility" \
52 --name="${_pkgname}" \
53 --exec="${pkgname} %U"
54 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
55 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
56 HOME="${srcdir}/.electron-gyp"
57 {
58 echo -e '\n'
59 #echo 'build_from_source=true'
60 echo "cache=${srcdir}/.npm_cache"
61 echo "maxsockets=10"
62 } >> .npmrc
63 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
64 {
65 echo 'registry=https://registry.npmmirror.com'
66 echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
67 echo 'electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/'
68 } >> .npmrc
69 find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
70 fi
71 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
72 NODE_ENV=development npm install --legacy-peer-deps
73 NODE_ENV=development npm add -D @electron-forge/plugin-local-electron
74}
75build() {
76 cd "${srcdir}/${pkgname}-${pkgver}"
77 local electronDist="/usr/lib/electron${_electronversion}"
78 sed -i -e "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
79 {\\
80 name: \"@electron-forge/plugin-local-electron\",\\
81 config: {\\
82 electronPath: \"${electronDist}\"\\
83 }\\
84 }," forge.config.ts
85 NODE_ENV=production npm run package
86}
87package() {
88 install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname}"
89 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
90 cp -Pr --no-preserve=ownership "${srcdir}/${pkgname}-${pkgver}/out/${_pkgname}-linux-"*/resources/app "${pkgdir}/usr/lib/${pkgname}"
91 _icon_sizes=(16x16 32x32 48x48 128x128 256x256 512x512)
92 for _icons in "${_icon_sizes[@]}";do
93 install -Dm644 "${srcdir}/${pkgname}-${pkgver}/src/icons/favicon.iconset/icon_${_icons}.png" \
94 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname}.png"
95 done
96 install -Dm644 "${srcdir}/${pkgname}-${pkgver}/out/${_pkgname}-linux-"*/LICENSE* -t "${pkgdir}/usr/share/licenses/${pkgname}"
97 install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
98}

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion