wavy-git

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The `yarn add -D @electron-forge/plugin-local-electron` call installs a package from the npm registry that is not listed in the project's package.json. However, `@electron-forge/plugin-local-electron` is a well-known, official package from the Electron Forge project (published by the Electron maintainers on the official npm registry), not from a personal or unofficial host. Its purpose here is clearly legitimate: it allows building with a system-installed Electron binary instead of downloading one, which is exactly the pattern used by many AUR Electron packages. The package is fetched from the standard npm registry (or its Chinese mirror), not from a personal/unofficial source. This is a common AUR pattern for packaging Electron apps against system Electron. The supply-chain risk is no greater than any other npm dependency install during build. The overall concern is low — it's slightly sloppy (the dependency could be added to package.json upstream or patched in), but not a meaningful security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The `yarn add -D @electron-forge/plugin-local-electron` call installs a package from the npm registry that is not listed in the project's package.json. However, `@electron-forge/plugin-local-electron` is a well-known, official package from the Electron Forge project (published by the Electron maintainers on the official npm registry), not from a personal or unofficial host. Its purpose here is clearly legitimate: it allows building with a system-installed Electron binary instead of downloading one, which is exactly the pattern used by many AUR Electron packages. The package is fetched from the standard npm registry (or its Chinese mirror), not from a personal/unofficial source. This is a common AUR pattern for packaging Electron apps against system Electron. The supply-chain risk is no greater than any other npm dependency install during build. The overall concern is low — it's slightly sloppy (the dependency could be added to package.json upstream or patched in), but not a meaningful security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:82 NODE_ENV=development yarn add -D @electron-forge/plugin-local-electron

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=wavy-git
    
      3_pkgname=Wavy
    
      4pkgver=1.1.3.r0.ga69c717
    
      5_electronversion=28
    
      6_nodeversion=22
    
      7pkgrel=1
    
      8pkgdesc="A simple protocol testing tool that supports various connection types(now serial port only).(Use system-wide electron)"
    
      9arch=('x86_64')
    
      10url="https://github.com/novrain/wavy"
    
      11license=('MIT')
    
      12provides=("${pkgname%-git}=${pkgver%.r*}")
    
      13conflicts=("${pkgname%-git}")
    
      14depends=(
    
  "electron${_electronversion}"
    
      16)
    
      17makedepends=(
    
  'npm'
    
  'nvm'
    
  'git'
    
  'curl'
    
  'yarn'
    
  'gendesk'
    
      24)
    
      25source=(
    
  "${pkgname//-/.}::git+${url}.git"
    
  "${pkgname%-git}.sh"
    
      28)
    
      29sha256sums=('SKIP'
    
          '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
    
      31pkgver() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  set -o pipefail
    
  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      36}
    
      37_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      42}
    
      43prepare() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname%-git}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${pkgname%-git}/g
    
      s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
    
  " "${srcdir}/${pkgname%-git}.sh"
    
  _ensure_local_nvm
    
  gendesk -q -f -n \
    
      --pkgname="${pkgname%-git}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="Utility" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname%-git} %U"
    
  export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  HOME="${srcdir}/.electron-gyp"
    
  mkdir -p "${srcdir}/.electron-gyp"
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      {
    
          echo -e '\n'
    
          echo 'registry "https://registry.npmmirror.com"'
    
          echo 'electron_mirror "https://registry.npmmirror.com/-/binary/electron/"'
    
          echo 'electron_builder_binaries_mirror "https://registry.npmmirror.com/-/binary/electron-builder-binaries/"'
    
          echo "cacheFolder "${srcdir}"/.yarn/cache"
    
          echo "pluginsFolder "${srcdir}"/.yarn/plugins"
    
          echo "globalFolder "${srcdir}"/.yarn/global"
    
          echo 'useHardlinks true'
    
          #echo 'buildFromSource true'
    
          echo 'linkWorkspacePackages true'
    
          echo 'fetchRetries 3'
    
          echo 'fetchRetryTimeout 10000'
    
          echo 'networkConcurrency 10'
    
      } >> .yarnrc
    
      find ./ -type f -name "yarn.lock" -exec sed -i "s/47.122.4.61:4873/registry.npmmirror.com/g;s/registry.yarnpkg.com/registry.npmmirror.com/g" {} +
    
  fi
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  NODE_ENV=development    yarn install --cache-folder "${srcdir}/.yarn_cache"
    
  NODE_ENV=development    yarn add -D @electron-forge/plugin-local-electron
    
      83}
    
      84build() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  local electronDist="/usr/lib/electron${_electronversion}"
    
  sed -i "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
    
  {\\
    
      name: \"@electron-forge/plugin-local-electron\",\\
    
      config: {\\
    
          electronPath: \'${electronDist}\',\\
    
      },\\
    
  }," forge.config.*
    
  NODE_ENV=production     yarn run electron:build
    
  NODE_ENV=production     yarn run vite:build
    
  NODE_ENV=production     yarn run forge:package
    
  rm -rf "${srcdir}/${pkgname//-/.}/out/${_pkgname}-linux-"*/resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/prebuilds/{android-*,darwin-*,linux-arm*,win32-*}
    
      99}
    
      100package() {
    
  install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
  install -Dm644 "${srcdir}/${pkgname//-/.}/out/${_pkgname}-linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"
    
  cp -Pr --no-preserve=ownership "${srcdir}/${pkgname//-/.}/out/${_pkgname}-linux-"*/resources/app.asar.unpacked "${pkgdir}/usr/lib/${pkgname%-git}"
    
  install -Dm644 "${srcdir}/${pkgname//-/.}/src/main/assets/tray-darwinTemplate.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
    
  install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      107}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2