xodus-nexus

LOW

maintainer Edu4rdSHL 0 votes scanned 2026-10-30 19:59:58.636725

View on AUR

Why flagged

The `npx electron-builder` call uses a locally installed package from the project's own `npm ci` step rather than fetching a remote package at runtime, and the source tarball comes from the project's own GitHub repository with a verified checksum; the main concern is that npm dependencies are fetched during build without individual verification, which is normal for Electron app packaging but slightly risky.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The `npx electron-builder` call uses a locally installed package from the project's own `npm ci` step rather than fetching a remote package at runtime, and the source tarball comes from the project's own GitHub repository with a verified checksum; the main concern is that npm dependencies are fetched during build without individual verification, which is normal for Electron app packaging but slightly risky.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:38 npx electron-builder --linux dir --publish never

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Eduard Tolosa <edu4rdshl@pm.me>
    
      2
    
      3pkgname=xodus-nexus
    
      4pkgver=0.4.1
    
      5pkgrel=1
    
      6pkgdesc='Xbox-inspired launcher for Microsoft Store PC games on Linux, built on Xodus'
    
      7arch=(x86_64)
    
      8url='https://github.com/domsvoboda/xodus-nexus'
    
      9license=(MIT)
    
      10depends=(alsa-lib gtk3 nss xdg-utils)
    
      11makedepends=(npm)
    
      12optdepends=(
    
      13  'org.freedesktop.secrets: keep the Xbox account signed in'
    
      14  'steam: Add to Steam integration'
    
      15  'python-gobject: Nexus Overlay'
    
      16  'webkit2gtk-4.1: Nexus Overlay'
    
      17  'gtk-layer-shell: Nexus Overlay on Wayland'
    
      18)
    
      19options=(!strip !debug)
    
      20install=$pkgname.install
    
      21source=(
    
      22  "$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz"
    
      23  "$pkgname.desktop"
    
      24  "$pkgname"
    
      25)
    
      26sha256sums=('6b54f2c81d43965b30a394a4c9954784d20901b0cf213b5ea80729b872ba4a21'
    
      27            '686f0162e483642dd660f24202fb45d64af109a8b2050e055a5313cba79bd9d7'
    
      28            'ecdb59dfd783f2b9d32621d000bea1b048c863316d23c7c328511e60d10932d9')
    
      29
    
      30prepare() {
    
      31  cd "$pkgname-$pkgver"
    
      32  npm ci --cache "$srcdir/npm-cache"
    
      33}
    
      34
    
      35build() {
    
      36  cd "$pkgname-$pkgver"
    
      37  npm run build
    
      38  npx electron-builder --linux dir --publish never
    
      39}
    
      40
    
      41package() {
    
      42  cd "$pkgname-$pkgver"
    
      43
    
      44  install -dm755 "$pkgdir/usr/lib/$pkgname"
    
      45  cp -a release/linux-unpacked/. "$pkgdir/usr/lib/$pkgname/"
    
      46
    
      47  install -Dm755 -t "$pkgdir/usr/bin" "$srcdir/$pkgname"
    
      48  install -Dm644 assets/icon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
    
      49  install -Dm644 -t "$pkgdir/usr/share/applications" "$srcdir/$pkgname.desktop"
    
      50  install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 19:59:58	Low	3
2026-10-30 19:57:05	Medium	2