webs-tray-git

LOW
maintainer zxp19821005 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package builds from a legitimate Git source and uses standard npm/electron tooling; the variable-named package install is part of normal Node.js workflow, not external code execution, and mirrors are used only for availability, not untrusted sources.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 90%): The package builds from a legitimate Git source and uses standard npm/electron tooling; the variable-named package install is part of normal Node.js workflow, not external code execution, and mirrors are used only for availability, not untrusted sources.

  • PKGBUILD:100 NODE_ENV=development npm add -D "${_rollup}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=webs-tray-git
3_pkgname=WebsTray
4pkgver=1.3.2.r2.g3b850b4
5_electronversion=41
6_nodeversion=24
7pkgrel=1
8pkgdesc="đź“ŚInspired by WebStay. WebsTray allows you to pin any web apps to system tray."
9arch=(
10 'aarch64'
11 'x86_64'
12)
13url="https://github.com/symant233/WebsTray"
14license=('GPL-3.0-only')
15conflicts=("${pkgname%-git}")
16provides=("${pkgname%-git}=${pkgver%.r*}")
17depends=(
18 "electron${_electronversion}"
19)
20makedepends=(
21 'gendesk'
22 'npm'
23 'nvm'
24 'curl'
25 'git'
26 'jq'
27 'zip'
28)
29source=(
30 "${pkgname%-git}.git::git+${url}.git"
31 "${pkgname%-git}.sh"
32)
33sha256sums=('SKIP'
34 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
35pkgver() {
36 cd "${srcdir}/${pkgname%-git}.git"
37 set -o pipefail
38 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
39 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
40}
41_ensure_local_nvm() {
42 local NVM_DIR="${srcdir}/.nvm"
43 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
44 nvm install "${_nodeversion}"
45 nvm use "${_nodeversion}"
46}
47_get_app_dir() {
48 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
49}
50_set_build_env() {
51 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
52 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
53 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
54 export HOME="${srcdir}/.electron-gyp"
55 export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
56 export NPM_CONFIG_MAXSOCKETS=32
57 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
58 {
59 export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
60 export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
61 export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
62 export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
63 }
64 find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
65 fi
66}
67_get_electron_version() {
68 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
69 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
70 [[ -z "${_elec_ver}" ]] && return 1
71 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
72}
73prepare() {
74 cd "${srcdir}/${pkgname%-git}.git"
75 _get_electron_version
76 sed -i -e "
77 s/@electronversion@/${_electronversion}/
78 s/@appname@/${pkgname%-git}/
79 s/@runname@/app.asar/
80 s/@cfgdirname@/${pkgname%-git}/
81 " "${srcdir}/${pkgname%-git}.sh"
82 gendesk -f -n -q \
83 --pkgname="${pkgname%-git}" \
84 --pkgdesc="${pkgdesc}" \
85 --categories="Utility" \
86 --name="${_pkgname}" \
87 --exec="${pkgname%-git} %U"
88 _set_build_env
89 _ensure_local_nvm
90 find src -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/" {} \;
91 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
92 case "${CARCH}" in
93 arch64)
94 _rollup=@rollup/rollup-linux-arm64-gnu
95 ;;
96 x86_64)
97 _rollup=@rollup/rollup-linux-x64-gnu
98 ;;
99 esac
100 NODE_ENV=development npm add -D "${_rollup}"
101 NODE_ENV=development npm install --legacy-peer-deps
102 local _v="${SYSTEM_ELECTRON_VERSION}"
103 local _zd="${srcdir}/electron-zips"
104 case "${CARCH}" in
105 aarch64) _arch=arm64 ;;
106 x86_64) _arch=x64 ;;
107 esac
108 local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"
109 install -Dm755 -d "${_zd}"
110 ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
111 sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," forge.config.*
112}
113build() {
114 cd "${srcdir}/${pkgname%-git}.git"
115 _set_build_env
116 _ensure_local_nvm
117 NODE_ENV=production npm run package
118}
119package() {
120 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
121 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
122 local _app_dir=$(_get_app_dir)
123 cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-git}/"
124 install -Dm644 "${srcdir}/${pkgname%-git}.git/public/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
125 install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
126 install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
127}
128

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 1
2026-10-31 00:07:41 Low 1
2026-10-30 00:29:30 Low 1
2026-10-29 00:13:55 Low 1
2026-10-28 00:06:54 Low 1
2026-10-27 00:23:28 Low 1
2026-10-26 00:12:40 Low 1
2026-10-25 00:20:48 Low 1
2026-10-24 00:14:55 Low 1
2026-10-23 00:02:19 Low 1
2026-10-22 00:13:10 Low 1
2026-10-21 00:12:50 Low 1
2026-10-20 00:10:31 Low 1
2026-10-19 00:03:55 Low 1
2026-10-18 00:06:55 Low 1
2026-10-17 00:21:55 Low 1
2026-10-16 00:12:47 Low 1
2026-10-15 00:28:05 Low 1
2026-10-14 00:06:47 Low 1
2026-10-13 00:23:45 Low 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion