wubi-dict-editor
maintainer zxp19821005
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The `yarn add -D @electron-forge/plugin-local-electron` installs a well-known, official package from the @electron-forge scope on the standard npm registry. This is a legitimate, widely-used Electron tooling package maintained by the Electron Forge project. The pattern of dynamically adding it during prepare() rather than declaring it in package.json is sloppy packaging practice, but @electron-forge/plugin-local-electron is not an unofficial or personal package — it is the standard mechanism for using a system-installed Electron binary with electron-forge. The source itself is pulled from the official GitHub repo via a tagged release. There is no binary from an unofficial host, no obfuscation, and no exfiltration. The main concern is that npm packages are fetched at build time without pinned checksums, which is a general AUR concern but not specific to this package. This is low severity: sloppy but not a meaningful supply-chain risk beyond what any yarn/npm-based AUR package carries.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The `yarn add -D @electron-forge/plugin-local-electron` installs a well-known, official package from the @electron-forge scope on the standard npm registry. This is a legitimate, widely-used Electron tooling package maintained by the Electron Forge project. The pattern of dynamically adding it during prepare() rather than declaring it in package.json is sloppy packaging practice, but @electron-forge/plugin-local-electron is not an unofficial or personal package — it is the standard mechanism for using a system-installed Electron binary with electron-forge. The source itself is pulled from the official GitHub repo via a tagged release. There is no binary from an unofficial host, no obfuscation, and no exfiltration. The main concern is that npm packages are fetched at build time without pinned checksums, which is a general AUR concern but not specific to this package. This is low severity: sloppy but not a meaningful supply-chain risk beyond what any yarn/npm-based AUR package carries.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:94
NODE_ENV=development yarn add -D @electron-forge/plugin-local-electron
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=wubi-dict-editor
3
_zhname='五笔码表助手'
4
pkgver=1.32
5
_electronversion=28
6
_nodeversion=20
7
pkgrel=1
8
pkgdesc="Five-stroke code assistant for Rime based on electron development.(Use syetem-wide electron)五笔码表助手 for Rime,基于 electron 开发."
9
arch=('x86_64')
10
url="https://github.com/KyleBing/wubi-dict-editor"
11
license=('GPL-3.0-only')
12
conflicts=("${pkgname}")
13
depends=(
14
#'ibus-rime'
15
"electron${_electronversion}"
16
'nodejs'
17
)
18
makedepends=(
19
'npm'
20
'yarn'
21
'nvm'
22
'gendesk'
23
'libicns'
24
'curl'
25
'git'
26
'jq'
27
)
28
options=(
29
'!emptydirs'
30
)
31
source=(
32
"${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}"
33
"${pkgname}.sh"
34
)
35
sha256sums=('be322533ecca90d5c087919f0ce0e9e94baaed9a4bcf41b78eaeb95d3184e83b'
36
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
37
_ensure_local_nvm() {
38
local NVM_DIR="${srcdir}/.nvm"
39
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
40
nvm install "${_nodeversion}"
41
nvm use "${_nodeversion}"
42
}
43
_get_electron_version() {
44
_elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
45
-exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
46
[[ -z "${_elec_ver}" ]] && return 1
47
echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
48
}
49
prepare() {
50
cd "${srcdir}/${pkgname}-${pkgver}"
51
_get_electron_version
52
sed -i -e "
53
s/@electronversion@/${_electronversion}/g
54
s/@appname@/${pkgname}/g
55
s/@runname@/app/g
56
s/@cfgdirname@/${pkgname}/g
57
" "${srcdir}/${pkgname}.sh"
58
gendesk -q -f -n \
59
--pkgname="${pkgname}" \
60
--pkgdesc="${pkgdesc}" \
61
--categories="Utility" \
62
--name="${pkgname}" \
63
--genericname="${_zhname} for Rime" \
64
--exec="${pkgname} %U" \
65
--custom="Name[zh_CN]=${_zhname}"
66
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
67
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
68
local HOME="${srcdir}/.electron-gyp"
69
mkdir -p "${srcdir}/.electron-gyp"
70
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
71
{
72
export YARN_REGISTRY="https://registry.npmmirror.com"
73
export ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
74
export ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
75
export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
76
export YARN_CACHE_FOLDER="${srcdir}/.yarn/cache"
77
export YARN_PLUGINS_FOLDER="${srcdir}/.yarn/plugins"
78
export YARN_GLOBAL_FOLDER="${srcdir}/.yarn/global"
79
export YARN_USE_HARDLINKS=true
80
# export YARN_BUILD_FROM_SOURCE=true
81
export YARN_LINK_WORKSPACE_PACKAGES=true
82
export YARN_FETCH_RETRIES=3
83
export YARN_FETCH_RETRY_TIMEOUT=10000
84
export YARN_NETWORK_CONCURRENCY=32
85
}
86
find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g;s/registry.npmjs.org/registry.npmmirror.com/g" {} +
87
find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
88
fi
89
_ensure_local_nvm
90
icns2png -d 32 -x assets/img/appIcon/appIcon.icns -o assets/img/appIcon/
91
cp assets/img/appIcon/appIcon_16x16x32.png assets/img/appIcon/appicon.png
92
sed -i "s/appIcon\/appicon\ico/img\/appIcon\/appicon\.png/g" main.js
93
NODE_ENV=development yarn install --cache-folder "${srcdir}/.yarn_cache"
94
NODE_ENV=development yarn add -D @electron-forge/plugin-local-electron
95
}
96
build() {
97
cd "${srcdir}/${pkgname}-${pkgver}"
98
_ensure_local_nvm
99
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
100
local electronDist="/usr/lib/electron${_electronversion}"
101
sed -i '/makers: \[/i\
102
plugins: [\
103
{\
104
name: "@electron-forge/plugin-local-electron",\
105
config: {\
106
electronPath: "'"${electronDist}"'",\
107
},\
108
},\
109
],' forge.config.*
110
NODE_ENV=production yarn run package
111
}
112
package() {
113
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
114
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
115
local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -exec dirname {} + | head -n 1)
116
cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname}/"
117
_icon_sizes=(16x16 32x32 256x256 512x512 1024x1024)
118
for _icons in "${_icon_sizes[@]}";do
119
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/assets/img/appIcon/appIcon_${_icons}x32.png" \
120
"${pkgdir}/usr/share/icons/hicolor/${_icons}/app/${pkgname}.png"
121
done
122
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
123
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
124
}
125
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |