yesplaymusic-git

MEDIUM
maintainer zxp19821005 1 votes scanned 2026-10-05 23:40:58.404909
View on AUR
Why flagged

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:149 npx prettier --write src/views/settings.vue

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2# Contributor and Ahthor: qier22 <qier222@outlook.com>
3pkgname=yesplaymusic-git
4_pkgname=YesPlayMusic
5pkgver=0.4.10.r9.gdf075cc
6_electronversion=13
7_nodeversion=16
8pkgrel=1
9pkgdesc="A third party music application for Netease Music.高颜值的第三方网易云播放器."
10arch=('any')
11url="https://music.qier222.com/"
12_ghurl="https://github.com/qier222/YesPlayMusic"
13license=('MIT')
14provides=("${pkgname%-git}=${pkgver%.r*}")
15conflicts=(
16 "${pkgname%-git}"
17 "my-${pkgname%-git}"
18 "${pkgname%-git}-appimage"
19 "${pkgname%-git}osd-electron"
20 "${pkgname%-git}osd-origin"
21 "r3play"
22 "r3playx"
23)
24depends=(
25 "electron${_electronversion}-bin"
26)
27makedepends=(
28 'npm'
29 'nvm'
30 'git'
31 'jq'
32 'yarn'
33 'gendesk'
34 'jq'
35)
36source=(
37 "${pkgname//-/.}::git+${_ghurl}.git"
38 "${pkgname%-git}.sh"
39)
40sha256sums=('SKIP'
41 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
42_get_project_dir() {
43 local d
44 while IFS= read -r d; do
45 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
46 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
47}
48pkgver() {
49 cd "$(_get_project_dir)"
50 set -o pipefail
51 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
52 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
53}
54_ensure_local_nvm() {
55 local NVM_DIR="${srcdir}/.nvm"
56 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
57 nvm install "${_nodeversion}"
58 nvm use "${_nodeversion}"
59}
60_get_app_dir() {
61 find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
62}
63_set_build_env() {
64 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
65 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
66 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
67 export ELECTRON_BUILDER_OFFLINE=true
68 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
69 export HOME="${srcdir}/.home"
70 export XDG_CACHE_HOME="${HOME}/.cache"
71 export XDG_CONFIG_HOME="${HOME}/.config"
72 export XDG_DATA_HOME="${HOME}/.local/share"
73 export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
74 export YARN_NETWORK_CONCURRENCY=32
75 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
76 export COREPACK_HOME="${HOME}/.corepack"
77 export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
78 local _yarnver _yarnmajor=0
79 _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
80 _yarnmajor="${_yarnver%%.*}"
81 _yarnmajor="${_yarnmajor:-0}"
82 if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
83 export XDG_STATE_HOME="${HOME}/.local/state"
84 export YARN_ENABLE_GLOBAL_CACHE=false
85 export YARN_ENABLE_MIRROR=false
86 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
87 export YARN_NODE_LINKER=node-modules
88 export YARN_NM_MODE=hardlinks-local
89 export YARN_ENABLE_TELEMETRY=false
90 export YARN_ENABLE_SCRIPTS=true
91 export YARN_HTTP_TIMEOUT=600000
92 export YARN_HTTP_RETRY=5
93 export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
94 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}"
95 else
96 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
97 export YARN_LINK_FOLDER="${HOME}/.yarn/link"
98 export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
99 export YARN_NETWORK_TIMEOUT=600000
100 export YARN_CHILD_CONCURRENCY="$(nproc)"
101 export YARN_FROZEN_LOCKFILE=true
102 export YARN_IGNORE_ENGINES=true
103 export YARN_PRODUCTION=false
104 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
105 fi
106 local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
107 _reg="${_reg%/}"
108 if [[ -f .yarnrc ]]; then
109 sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
110 fi
111 if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
112 sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
113 fi
114}
115_get_electron_version() {
116 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
117 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
118 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
119 [[ -z "${_elec_ver}" ]] && return 1
120 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
121}
122prepare() {
123 cd "$(_get_project_dir)"
124 _get_electron_version
125 sed -i -e "
126 s/@electronversion@/${_electronversion}/g
127 s/@appname@/${pkgname%-git}/g
128 s/@runname@/app.asar/g
129 s/@cfgdirname@/${pkgname%-git}/g
130 " "${srcdir}/${pkgname%-git}.sh"
131 gendesk -q -f -n \
132 --pkgname="${pkgname%-git}" \
133 --pkgdesc="${pkgdesc}" \
134 --categories="AudioVideo" \
135 --name="${_pkgname}" \
136 --exec="${pkgname%-git} %U"
137 _ensure_local_nvm
138 _set_build_env
139 cp -f .env.example .env
140 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
141 sed -i "/productName: 'YesPlayMusic'/a\\
142 electronDist: \"${ELECTRON_DIST}\"," vue.config.js
143 yarn --ignore-optional
144 local unm_version
145 unm_version="$(node -e "console.log(require('./node_modules/@unblockneteasemusic/rust-napi/package.json').version)")"
146 yarn add --ignore-platform --ignore-optional \
147 "@unblockneteasemusic/rust-napi-linux-x64-gnu@${unm_version}"
148 echo "${ELECTRON_DIST}/electron" > node_modules/electron/path.txt
149 npx prettier --write src/views/settings.vue
150}
151build() {
152 cd "$(_get_project_dir)"
153 _ensure_local_nvm
154 _set_build_env
155 export DISABLE_ESLINT_PLUGIN=true
156 export NODE_ENV=production
157 yarn run prettier
158 yarn run electron:build-linux --dir
159}
160package() {
161 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
162 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
163 local _app_dir="$(_get_app_dir)"
164 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
165 local _src="$(_get_project_dir)"
166 _icon_sizes=(16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
167 for _icons in "${_icon_sizes[@]}";do
168 install -Dm644 "${_src}/build/icons/${_icons}.png" \
169 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
170 done
171 install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
172 install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
173}

Changes since previous scan

--- PKGBUILD @ 2026-07-21 05:16
+++ PKGBUILD @ 2026-10-05 23:40
@@ -6,7 +6,7 @@
_electronversion=13
_nodeversion=16
pkgrel=1
-pkgdesc="A third party music application for Netease Music.(Use system-wide electron).高颜值的第三方网易云播放器."
+pkgdesc="A third party music application for Netease Music.高颜值的第三方网易云播放器."
arch=('any')
url="https://music.qier222.com/"
_ghurl="https://github.com/qier222/YesPlayMusic"
@@ -22,13 +22,13 @@
"r3playx"
)
depends=(
- "electron${_electronversion}"
+ "electron${_electronversion}-bin"
)
makedepends=(
'npm'
'nvm'
'git'
- 'curl'
+ 'jq'
'yarn'
'gendesk'
'jq'
@@ -38,9 +38,15 @@
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
@@ -52,41 +58,69 @@
nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
}
_set_build_env() {
- export electronDist="/usr/lib/electron${_electronversion}"
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- export HOME="${srcdir}/.electron-gyp"
- mkdir -p "${srcdir}/.electron-gyp"
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export YARN_REGISTRY="https://registry.npmmirror.com"
- export ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
- export ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- export YARN_CACHE_FOLDER="${srcdir}/.yarn/cache"
- export YARN_PLUGINS_FOLDER="${srcdir}/.yarn/plugins"
- export YARN_GLOBAL_FOLDER="${srcdir}/.yarn/global"
- export YARN_USE_HARDLINKS=true
- # export YARN_BUILD_FROM_SOURCE=true
- export YARN_LINK_WORKSPACE_PACKAGES=true
- export YARN_FETCH_RETRIES=3
- export YARN_FETCH_RETRY_TIMEOUT=10000
- export YARN_NETWORK_CONCURRENCY=32
- }
- find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g" {} +
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
+ export YARN_NETWORK_CONCURRENCY=32
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
+ local _yarnver _yarnmajor=0
+ _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
+ _yarnmajor="${_yarnver%%.*}"
+ _yarnmajor="${_yarnmajor:-0}"
+ if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export YARN_ENABLE_GLOBAL_CACHE=false
+ export YARN_ENABLE_MIRROR=false
+ export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
+ export YARN_NODE_LINKER=node-modules
+ export YARN_NM_MODE=hardlinks-local
+ export YARN_ENABLE_TELEMETRY=false
+ export YARN_ENABLE_SCRIPTS=true
+ export YARN_HTTP_TIMEOUT=600000
+ export YARN_HTTP_RETRY=5
+ export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}"
+ else
+ export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
+ export YARN_LINK_FOLDER="${HOME}/.yarn/link"
+ export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
+ export YARN_NETWORK_TIMEOUT=600000
+ export YARN_CHILD_CONCURRENCY="$(nproc)"
+ export YARN_FROZEN_LOCKFILE=true
+ export YARN_IGNORE_ENGINES=true
+ export YARN_PRODUCTION=false
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
+ fi
+ local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
+ _reg="${_reg%/}"
+ if [[ -f .yarnrc ]]; then
+ sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
+ fi
+ if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
+ sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
fi
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
@@ -100,32 +134,40 @@
--categories="AudioVideo" \
--name="${_pkgname}" \
--exec="${pkgname%-git} %U"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
cp -f .env.example .env
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
sed -i "/productName: 'YesPlayMusic'/a\\
- electronDist: \"/usr/lib/electron${_electronversion}\"," vue.config.js
- NODE_ENV=development yarn install --cache-folder "${srcdir}/.yarn_cache"
- echo "/usr/lib/electron${_electronversion}/electron" > node_modules/electron/path.txt
+ electronDist: \"${ELECTRON_DIST}\"," vue.config.js
+ yarn --ignore-optional
+ local unm_version
+ unm_version="$(node -e "console.log(require('./node_modules/@unblockneteasemusic/rust-napi/package.json').version)")"
+ yarn add --ignore-platform --ignore-optional \
+ "@unblockneteasemusic/rust-napi-linux-x64-gnu@${unm_version}"
+ echo "${ELECTRON_DIST}/electron" > node_modules/electron/path.txt
+ npx prettier --write src/views/settings.vue
}
build() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- DISABLE_ESLINT_PLUGIN=true NODE_ENV=production yarn run electron:build-linux --dir
+ export DISABLE_ESLINT_PLUGIN=true
+ export NODE_ENV=production
+ yarn run prettier
+ yarn run electron:build-linux --dir
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
+ local _app_dir="$(_get_app_dir)"
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ local _src="$(_get_project_dir)"
_icon_sizes=(16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
for _icons in "${_icon_sizes[@]}";do
- install -Dm644 "${srcdir}/${pkgname//-/.}/build/icons/${_icons}.png" \
+ install -Dm644 "${_src}/build/icons/${_icons}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
done
- install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
-

Scan history

Scanned at (UTC)SeverityRules
2026-10-05 23:40:58 Medium 1
2026-07-21 05:16:02 Clean 0
2026-06-26 00:23:49 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion