woocommerce-pos

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command runs 'electron-forge package' which is a standard build tool for packaging Electron apps, and all sources are from legitimate project repositories; the command does not execute arbitrary remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs 'electron-forge package' which is a standard build tool for packaging Electron apps, and all sources are from legitimate project repositories; the command does not execute arbitrary remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:76 npx electron-forge package

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=woocommerce-pos
    
      3_pkgname=WooCommerce-POS
    
      4pkgver=1.6.2
    
      5_electronversion=30
    
      6_nodeversion=20
    
      7pkgrel=1
    
      8pkgdesc="Electron Desktop App for WooCommerce POS"
    
      9arch=('x86_64')
    
      10url="https://github.com/wcpos/electron"
    
      11license=('MIT')
    
      12conflicts=("${pkgname}")
    
      13depends=(
    
  "electron${_electronversion}"
    
      15)
    
      16makedepends=(
    
  'npm'
    
  'nvm'
    
  'gendesk'
    
  'yarn'
    
  'gcc'
    
  'cmake'
    
  'curl'
    
      24)
    
      25source=(
    
  "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
  "expo.git::git+https://github.com/wcpos/managed-expo.git"
    
  "${pkgname}.sh"
    
      29)
    
      30sha256sums=('8f25dc488ca9fd5f840724550e0af47a97687c092aca48821524f91d387d9ba2'
    
          'SKIP'
    
          '2b2e8aeed33fd71c521e49fd54fb2fa81218d16aef8bccb88d77909055ab8051')
    
      33_ensure_local_nvm() {
    
  export NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      38}
    
      39build() {
    
  sed -e "s|@electronversion@|${_electronversion}|" \
    
      -e "s|@appname@|${pkgname}|g" \
    
      -e "s|@runname@|app.asar|g" \
    
      -e "s|@cfgdirname@|${_pkgname//-/ }|g" \
    
      -e "s|@options@|env ELECTRON_OZONE_PLATFORM_HINT=auto|g" \
    
      -i "${srcdir}/${pkgname}.sh"
    
  _ensure_local_nvm
    
  gendesk -f -n -q --pkgname="${pkgname}" --pkgdesc="${pkgdesc}" --categories="Development" --name="${_pkgname}" --exec="${pkgname} %U"
    
  export npm_config_build_from_source=true
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  #export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  #export npm_config_target="${SYSTEM_ELECTRON_VERSION}"
    
  #export ELECTRONVERSION="${_electronversion}"
    
  HOME="${srcdir}/.electron-gyp"
    
  mkdir -p "${srcdir}/.electron-gyp"
    
  touch "${srcdir}/.electron-gyp/.yarnrc"
    
  if [ `curl -s ipinfo.io/country | grep CN | wc -l ` -ge 1 ];then
    
      export npm_config_registry=https://registry.npmmirror.com
    
      export npm_config_disturl=https://registry.npmmirror.com/-/binary/node/
    
      export npm_config_electron_mirror=https://registry.npmmirror.com/-/binary/electron/
    
      export npm_config_electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/
    
  else
    
      echo "Your network is OK."
    
  fi
    
  cd "${srcdir}/expo.git"
    
  # .yarnrc.yml existed.
    
  yarn install
    
  yarn export:electron
    
  # Fix bundle path
    
  sed -i 's/src="\/_expo/src="_expo/g' dist/index.html
    
  cd "${srcdir}/electron-${pkgver}"
    
  sed "s|process.resourcesPath|\"\/usr\/lib\/${pkgname}\"|g" -i src/main/util.ts
    
  cp -r "${srcdir}/expo.git/dist" "${srcdir}/electron-${pkgver}"
    
  # .yarnrc.yml existed.
    
  yarn install
    
  yarn run rebuild:all
    
  npx electron-forge package
    
      77}
    
      78package() {
    
  install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
    
  cp -r "${srcdir}/electron-${pkgver}/out/${_pkgname//-/ }-linux-"*/resources/{app,dist} "${pkgdir}/usr/lib/${pkgname}"
    
  install -Dm644 "${srcdir}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/electron-${pkgver}/icons/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
  install -Dm644 "${srcdir}/electron-${pkgver}/out/${_pkgname//-/ }-linux-"*/LICENSE* -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      85}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2