xiami

LOW

maintainer lzsnyy 0 votes scanned 2026-08-29 07:40:33.314064

View on AUR

Why flagged

The `npx tauri build` invocation runs a locally installed npm package (tauri CLI installed via `npm install` from the project's own package.json), not a remote package fetched at runtime; the source is pinned to a specific GitHub commit with a sha256 checksum, making this a normal Tauri project build with no obfuscated payloads or exfiltration, though the package is new/low-vote and builds from a personal GitHub repo.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The `npx tauri build` invocation runs a locally installed npm package (tauri CLI installed via `npm install` from the project's own package.json), not a remote package fetched at runtime; the source is pinned to a specific GitHub commit with a sha256 checksum, making this a normal Tauri project build with no obfuscated payloads or exfiltration, though the package is new/low-vote and builds from a personal GitHub repo.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:33 npx tauri build --no-bundle

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lzsnyy <710080675@qq.com>
    
      2# Contributor: zhangxunvvv (original author) <https://github.com/zhangxunvvv>
    
      3
    
      4pkgname=xiami
    
      5pkgver=0.2.0
    
      6_commit=e3fa80f3034a5ccb7255e70e09cb0545af705231
    
      7pkgrel=1
    
      8pkgdesc="虾米 — 长篇小说 Agent 创作与无人值守生产工作台 (Tauri 2)"
    
      9arch=('x86_64' 'aarch64')
    
      10url="https://github.com/zhangxunvvv/xiami"
    
      11license=('Apache-2.0')
    
      12options=('!lto')
    
      13depends=('gtk3' 'webkit2gtk-4.1')
    
      14makedepends=('cargo' 'rust' 'nodejs' 'npm')
    
      15# 上游未打 tag，固定到 main 分支最新提交
    
      16source=("${pkgname}-${pkgver}.tar.gz::https://github.com/zhangxunvvv/xiami/archive/${_commit}.tar.gz")
    
      17sha256sums=('a56416273dff0509632d8be793d020d93596060fed1779a04c458cb8c39a21be')
    
      18
    
      19prepare() {
    
      20    cd "xiami-${_commit}"
    
      21    export CARGO_HOME="${srcdir}/cargo-home"
    
      22    # 上游 package-lock.json 与 package.json 不同步，无法用 npm ci
    
      23    npm install --allow-remote=all
    
      24    # 预取并锁定 crate 依赖
    
      25    (cd src-tauri && cargo fetch --locked)
    
      26}
    
      27
    
      28build() {
    
      29    cd "xiami-${_commit}"
    
      30    export CARGO_HOME="${srcdir}/cargo-home"
    
      31    export RUSTUP_TOOLCHAIN=stable
    
      32    # 只编译二进制，不打 nsis/msi 包（上游 bundle 目标仅针对 Windows）
    
      33    npx tauri build --no-bundle
    
      34}
    
      35
    
      36package() {
    
      37    cd "xiami-${_commit}"
    
      38    install -Dm755 src-tauri/target/release/xiami-desktop "${pkgdir}/usr/bin/xiami"
    
      39
    
      40    local _icon
    
      41    for _icon in 32x32 64x64 128x128; do
    
      42        install -Dm644 "src-tauri/icons/${_icon}.png" \
    
      43            "${pkgdir}/usr/share/icons/hicolor/${_icon}/apps/xiami.png"
    
      44    done
    
      45    install -Dm644 "src-tauri/icons/128x128@2x.png" \
    
      46        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/xiami.png"
    
      47
    
      48    cat > xiami.desktop <<EOF
    
      49[Desktop Entry]
    
      50Type=Application
    
      51Name=Xiami
    
      52GenericName=虾米
    
      53Comment=长篇小说 Agent 创作与无人值守生产工作台
    
      54Exec=/usr/bin/xiami
    
      55Icon=xiami
    
      56Categories=Office;TextEditor;
    
      57StartupWMClass=com.xiami.desktop
    
      58EOF
    
      59    install -Dm644 xiami.desktop "${pkgdir}/usr/share/applications/xiami.desktop"
    
      60
    
      61    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-29 07:40:33	Low	3
2026-08-29 07:38:41	Medium	2