workbuddy

maintainer Rainbowu · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt DMG from a non-official, non-whitelisted host (download.codebuddy.cn) with SKIP'd checksums, and runs 'npm install' on external, undeclared packages (@lydell/node-pty, better-sqlite3@13) during build, creating a supply-chain risk if the source or npm packages are compromised.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:46 npm install @lydell/node-pty better-sqlite3@13 --omit=dev

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "https://download.codebuddy.cn/workbuddy/saas/darwin-x64/WorkBuddy-darwin-x64-${pkgver}-${_commit}.dmg"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt DMG from a non-official, non-whitelisted host (download.codebuddy.cn) with SKIP'd checksums, and runs 'npm install' on external, undeclared packages (@lydell/node-pty, better-sqlite3@13) during build, creating a supply-chain risk if the source or npm packages are compromised.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Rongbo <wurongbo2012@hotmail.com>
    
      2
    
      3pkgname=workbuddy
    
      4pkgver=5.3.5.34189228
    
      5pkgrel=2
    
      6_commit=8044e898
    
      7pkgdesc="Work Smart，Not Hard"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://www.codebuddy.ai/agents"
    
      10license=('custom')
    
      11depends=('electron')
    
      12makedepends=('7zip'
    
      13	'npm'
    
      14	'libicns'
    
      15	'asar'
    
      16)
    
      17checkdepends=()
    
      18optdepends=(
    
      19	'nodejs-lts: frontend skills'
    
      20	'gnome-shell-extension-appindicator'
    
      21)
    
      22provides=()
    
      23conflicts=()
    
      24source=(
    
      25  "https://download.codebuddy.cn/workbuddy/saas/darwin-x64/WorkBuddy-darwin-x64-${pkgver}-${_commit}.dmg"
    
      26  WorkBuddy.desktop
    
      27)
    
      28sha256sums=(
    
      29  'SKIP'
    
      30  'SKIP'
    
      31)
    
      32
    
      33options=(!strip)
    
      34prepare() {
    
      35    rm -rf WorkBuddy/WorkBuddy.app/Contents/Resources/
    
      36    7z -snld x WorkBuddy-darwin-x64-${pkgver}-${_commit}.dmg
    
      37    mkdir -p WorkBuddy.app/Contents/Resources/node_modules
    
      38}
    
      39
    
      40build() {
    
      41	cd WorkBuddy.app/Contents/Resources
    
      42	icns2png -x icon.icns
    
      43	asar e app.asar app.asar.unpacked || continue
    
      44	find app.asar.unpacked -type f -exec sed -i "s/process.resourcesPath/\'\/opt\/workbuddy\'/g" {} +
    
      45	#npm install @tencent-ai/codebuddy-code --omit=dev
    
      46	npm install @lydell/node-pty better-sqlite3@13 --omit=dev
    
      47	cp -a node_modules/* app.asar.unpacked/node_modules
    
      48}
    
      49
    
      50package() {
    
      51    install -D WorkBuddy.desktop ${pkgdir}/usr/share/applications/workbuddy.desktop
    
      52    cd WorkBuddy.app/Contents/Resources
    
      53    install -D icon_512x512x32.png ${pkgdir}/usr/share/icons/hicolor/512x512/apps/WorkBuddy.png
    
      54    install -D icon_1024x1024x32.png ${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/WorkBuddy.png
    
      55    install -d ${pkgdir}/opt/workbuddy
    
      56    cp -a app.asar.unpacked ${pkgdir}/opt/workbuddy/
    
      57    install -Dm 755 /dev/stdin "${pkgdir}/usr/bin/workbuddy" <<EOF
    
      58#!/usr/bin/bash
    
      59exec electron /opt/workbuddy/app.asar.unpacked "\$@"
    
      60EOF
    
      61}
    
      62

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 
 pkgname=workbuddy
 pkgver=5.3.5.34189228
-pkgrel=1
+pkgrel=2
 _commit=8044e898
 pkgdesc="Work Smart，Not Hard"
 arch=('x86_64' 'aarch64')
@@ -16,21 +16,24 @@
 )
 checkdepends=()
 optdepends=(
+	'nodejs-lts: frontend skills'
 	'gnome-shell-extension-appindicator'
 )
 provides=()
 conflicts=()
-source=("https://download.codebuddy.cn/workbuddy/saas/darwin-x64/WorkBuddy-darwin-x64-${pkgver}-${_commit}.dmg"
-WorkBuddy.desktop
+source=(
+  "https://download.codebuddy.cn/workbuddy/saas/darwin-x64/WorkBuddy-darwin-x64-${pkgver}-${_commit}.dmg"
+  WorkBuddy.desktop
 )
-sha256sums=('SKIP'
-'SKIP'
+sha256sums=(
+  'SKIP'
+  'SKIP'
 )
 
 options=(!strip)
 prepare() {
     rm -rf WorkBuddy/WorkBuddy.app/Contents/Resources/
-    7z x -snld WorkBuddy-darwin-x64-${pkgver}-${_commit}.dmg
+    7z -snld x WorkBuddy-darwin-x64-${pkgver}-${_commit}.dmg
     mkdir -p WorkBuddy.app/Contents/Resources/node_modules
 }
 
@@ -42,10 +45,6 @@
 	#npm install @tencent-ai/codebuddy-code --omit=dev
 	npm install @lydell/node-pty better-sqlite3@13 --omit=dev
 	cp -a node_modules/* app.asar.unpacked/node_modules
-	#cd app.asar.unpacked/
-	#rm -rf cli && mv node_modules/@tencent-ai/codebuddy-code cli
-#	#npm install @vscode/ripgrep @vscode/sqlite3 @vscode/spdlog --omit=dev
-#	#cp -a node_modules/* app/node_modules/
 }
 
 package() {
@@ -54,7 +53,6 @@
     install -D icon_512x512x32.png ${pkgdir}/usr/share/icons/hicolor/512x512/apps/WorkBuddy.png
     install -D icon_1024x1024x32.png ${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/WorkBuddy.png
     install -d ${pkgdir}/opt/workbuddy
-    install -d ${pkgdir}/usr/share/licenses/workbuddy
     cp -a app.asar.unpacked ${pkgdir}/opt/workbuddy/
     install -Dm 755 /dev/stdin "${pkgdir}/usr/bin/workbuddy" <<EOF
 #!/usr/bin/bash

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	4
2026-08-02 00:16:08	MEDIUM	4
2026-08-01 03:19:42	MEDIUM	4
2026-08-01 00:11:18	MEDIUM	4
2026-07-31 00:14:10	MEDIUM	4
2026-07-30 01:16:14	MEDIUM	4
2026-07-30 01:13:52	MEDIUM	4