woocommerce-pos

LOW

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx command runs 'electron-forge package' which is a standard build tool for packaging Electron apps, and all sources are from legitimate project repositories; the command does not execute arbitrary remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs 'electron-forge package' which is a standard build tool for packaging Electron apps, and all sources are from legitimate project repositories; the command does not execute arbitrary remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:76 npx electron-forge package

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=woocommerce-pos
    
      3_pkgname=WooCommerce-POS
    
      4pkgver=1.6.2
    
      5_electronversion=30
    
      6_nodeversion=20
    
      7pkgrel=1
    
      8pkgdesc="Electron Desktop App for WooCommerce POS"
    
      9arch=('x86_64')
    
      10url="https://github.com/wcpos/electron"
    
      11license=('MIT')
    
      12conflicts=("${pkgname}")
    
      13depends=(
    
  "electron${_electronversion}"
    
      15)
    
      16makedepends=(
    
  'npm'
    
  'nvm'
    
  'gendesk'
    
  'yarn'
    
  'gcc'
    
  'cmake'
    
  'curl'
    
      24)
    
      25source=(
    
  "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
  "expo.git::git+https://github.com/wcpos/managed-expo.git"
    
  "${pkgname}.sh"
    
      29)
    
      30sha256sums=('8f25dc488ca9fd5f840724550e0af47a97687c092aca48821524f91d387d9ba2'
    
          'SKIP'
    
          '2b2e8aeed33fd71c521e49fd54fb2fa81218d16aef8bccb88d77909055ab8051')
    
      33_ensure_local_nvm() {
    
  export NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      38}
    
      39build() {
    
  sed -e "s|@electronversion@|${_electronversion}|" \
    
      -e "s|@appname@|${pkgname}|g" \
    
      -e "s|@runname@|app.asar|g" \
    
      -e "s|@cfgdirname@|${_pkgname//-/ }|g" \
    
      -e "s|@options@|env ELECTRON_OZONE_PLATFORM_HINT=auto|g" \
    
      -i "${srcdir}/${pkgname}.sh"
    
  _ensure_local_nvm
    
  gendesk -f -n -q --pkgname="${pkgname}" --pkgdesc="${pkgdesc}" --categories="Development" --name="${_pkgname}" --exec="${pkgname} %U"
    
  export npm_config_build_from_source=true
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  #export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  #export npm_config_target="${SYSTEM_ELECTRON_VERSION}"
    
  #export ELECTRONVERSION="${_electronversion}"
    
  HOME="${srcdir}/.electron-gyp"
    
  mkdir -p "${srcdir}/.electron-gyp"
    
  touch "${srcdir}/.electron-gyp/.yarnrc"
    
  if [ `curl -s ipinfo.io/country | grep CN | wc -l ` -ge 1 ];then
    
      export npm_config_registry=https://registry.npmmirror.com
    
      export npm_config_disturl=https://registry.npmmirror.com/-/binary/node/
    
      export npm_config_electron_mirror=https://registry.npmmirror.com/-/binary/electron/
    
      export npm_config_electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/
    
  else
    
      echo "Your network is OK."
    
  fi
    
  cd "${srcdir}/expo.git"
    
  # .yarnrc.yml existed.
    
  yarn install
    
  yarn export:electron
    
  # Fix bundle path
    
  sed -i 's/src="\/_expo/src="_expo/g' dist/index.html
    
  cd "${srcdir}/electron-${pkgver}"
    
  sed "s|process.resourcesPath|\"\/usr\/lib\/${pkgname}\"|g" -i src/main/util.ts
    
  cp -r "${srcdir}/expo.git/dist" "${srcdir}/electron-${pkgver}"
    
  # .yarnrc.yml existed.
    
  yarn install
    
  yarn run rebuild:all
    
  npx electron-forge package
    
      77}
    
      78package() {
    
  install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
    
  cp -r "${srcdir}/electron-${pkgver}/out/${_pkgname//-/ }-linux-"*/resources/{app,dist} "${pkgdir}/usr/lib/${pkgname}"
    
  install -Dm644 "${srcdir}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/electron-${pkgver}/icons/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
  install -Dm644 "${srcdir}/electron-${pkgver}/out/${_pkgname//-/ }-linux-"*/LICENSE* -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      85}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2