witsy

LOW
maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The npm install runs during build from the project's own source (git checkout), using declared dependencies; the flagged 'external package' install is part of normal build process with no evidence of hidden or malicious payloads.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install runs during build from the project's own source (git checkout), using declared dependencies; the flagged 'external package' install is part of normal build process with no evidence of hidden or malicious payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:86 NODE_ENV=development npm add -D node-gyp

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=witsy
3_pkgname=Witsy
4pkgver=3.5.2
5_electronversion=38
6_nodeversion=22
7pkgrel=2
8pkgdesc="Generative AI desktop application."
9arch=('any')
10url="https://github.com/Kochava-Studios/witsy"
11license=('Apache-2.0')
12conflicts=("${pkgname}")
13depends=(
14 "electron${_electronversion}"
15 'libevdev'
16 'nodejs'
17 'libvips'
18)
19makedepends=(
20 'gendesk'
21 'npm'
22 'nvm'
23 'curl'
24 'git'
25 'jq'
26 'zip'
27)
28source=(
29 "${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}"
30 "${pkgname}.sh"
31)
32sha256sums=('34700f1f741cef1f61d040448f6eb50c93be1adc351bdf895489d3f92b84d38f'
33 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
34_ensure_local_nvm() {
35 local NVM_DIR="${srcdir}/.nvm"
36 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
37 nvm install "${_nodeversion}"
38 nvm use "${_nodeversion}"
39}
40_get_app_dir() {
41 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
42}
43_get_electron_version() {
44 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
45 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
46 [[ -z "${_elec_ver}" ]] && return 1
47 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
48}
49_set_build_env() {
50 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
51 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
52 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
53 export HOME="${srcdir}/.electron-gyp"
54 export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
55 export NPM_CONFIG_MAXSOCKETS=32
56 # Force sharp to use prebuilt binary instead of building from source
57 export SHARP_IGNORE_GLOBAL_LIBVIPS=1
58 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
59 {
60 export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
61 export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
62 export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
63 export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
64 }
65 find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
66 fi
67}
68prepare() {
69 cd "${srcdir}/${pkgname}-${pkgver}"
70 _get_electron_version
71 sed -i -e "
72 s/@electronversion@/${_electronversion}/g
73 s/@appname@/${pkgname}/g
74 s/@runname@/app.asar/g
75 s/@cfgdirname@/${_pkgname}/g
76 " "${srcdir}/${pkgname}.sh"
77 gendesk -q -f -n \
78 --pkgname="${pkgname}" \
79 --pkgdesc="${pkgdesc}" \
80 --categories="Utility" \
81 --name="${_pkgname}" \
82 --exec="${pkgname} %U"
83 _set_build_env
84 _ensure_local_nvm
85 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
86 NODE_ENV=development npm add -D node-gyp
87 NODE_ENV=development npm install --legacy-peer-deps
88 # Use system-wide electron binary
89 local _v="${SYSTEM_ELECTRON_VERSION}"
90 local _zd="${srcdir}/electron-zips"
91 case "${CARCH}" in
92 aarch64) _arch=arm64 ;;
93 x86_64) _arch=x64 ;;
94 esac
95 local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"
96 install -Dm755 -d "${_zd}"
97 ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
98 sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," forge.config.*
99}
100build() {
101 cd "${srcdir}/${pkgname}-${pkgver}"
102 _set_build_env
103 _ensure_local_nvm
104 export NODE_OPTIONS="--max_old_space_size=4096"
105 NODE_ENV=production npm run package
106}
107package() {
108 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
109 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
110 cp -a "${srcdir}/${pkgname}-${pkgver}/out/${_pkgname}-linux-"*"/resources/". "${pkgdir}/usr/lib/${pkgname}/"
111 install -Dm644 "${srcdir}/${pkgname}-${pkgver}/assets/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
112 install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
113 install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
114}
115

Changes since previous scan

--- PKGBUILD @ 2026-09-10 00:22
+++ PKGBUILD @ 2026-09-17 00:27
@@ -5,7 +5,7 @@
_electronversion=38
_nodeversion=22
pkgrel=2
-pkgdesc="Generative AI desktop application.(Use system-wide electron)"
+pkgdesc="Generative AI desktop application."
arch=('any')
url="https://github.com/Kochava-Studios/witsy"
license=('Apache-2.0')
@@ -13,7 +13,8 @@
depends=(
"electron${_electronversion}"
'libevdev'
- 'java-runtime'
+ 'nodejs'
+ 'libvips'
)
makedepends=(
'gendesk'
@@ -22,23 +23,47 @@
'curl'
'git'
'jq'
+ 'zip'
)
source=(
"${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}"
"${pkgname}.sh"
)
sha256sums=('34700f1f741cef1f61d040448f6eb50c93be1adc351bdf895489d3f92b84d38f'
- '31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
+ 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
+_get_app_dir() {
+ find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+}
_get_electron_version() {
- _elec_ver=$(jq -r '.devDependencies["electron"] // .dependencies["electron"]' "${srcdir}/${pkgname}-${pkgver}/package.json" | tr -d '^')
- _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
- echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
+ _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
+ -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+}
+_set_build_env() {
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
+ export HOME="${srcdir}/.electron-gyp"
+ export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
+ export NPM_CONFIG_MAXSOCKETS=32
+ # Force sharp to use prebuilt binary instead of building from source
+ export SHARP_IGNORE_GLOBAL_LIBVIPS=1
+ if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
+ {
+ export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
+ export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
+ export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
+ export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
+ }
+ find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
+ fi
}
prepare() {
cd "${srcdir}/${pkgname}-${pkgver}"
@@ -48,7 +73,6 @@
s/@appname@/${pkgname}/g
s/@runname@/app.asar/g
s/@cfgdirname@/${_pkgname}/g
- s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
" "${srcdir}/${pkgname}.sh"
gendesk -q -f -n \
--pkgname="${pkgname}" \
@@ -56,40 +80,28 @@
--categories="Utility" \
--name="${_pkgname}" \
--exec="${pkgname} %U"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- HOME="${srcdir}/.electron-gyp"
- {
- echo -e '\n'
- #echo 'build_from_source=true'
- echo "cache=${srcdir}/.npm_cache"
- echo "maxsockets=32"
- } >> .npmrc
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- echo 'registry=https://registry.npmmirror.com'
- echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
- echo 'electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/'
- } >> .npmrc
- find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
- fi
+ _set_build_env
_ensure_local_nvm
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development npm install
- NODE_ENV=development npm add -D @electron-forge/plugin-local-electron
+ NODE_ENV=development npm add -D node-gyp
+ NODE_ENV=development npm install --legacy-peer-deps
+ # Use system-wide electron binary
+ local _v="${SYSTEM_ELECTRON_VERSION}"
+ local _zd="${srcdir}/electron-zips"
+ case "${CARCH}" in
+ aarch64) _arch=arm64 ;;
+ x86_64) _arch=x64 ;;
+ esac
+ local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"
+ install -Dm755 -d "${_zd}"
+ ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
+ sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," forge.config.*
}
build() {
cd "${srcdir}/${pkgname}-${pkgver}"
+ _set_build_env
_ensure_local_nvm
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- local electronDist="/usr/lib/electron${_electronversion}"
- sed -i "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
- {\\
- name: \"@electron-forge/plugin-local-electron\",\\
- config: {\\
- electronPath: \'${electronDist}\',\\
- },\\
- }," forge.config.*
+ export NODE_OPTIONS="--max_old_space_size=4096"
NODE_ENV=production npm run package
}
package() {

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 03:20:13 Medium 1
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion