yet-another-electron-term

LOW
maintainer zxp19821005 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The npx commands (npx --yes patch-package, npx ng build) are used to run build tools from locally installed npm packages in a project-owned source tree; this is standard practice in Node.js projects and does not execute untrusted remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx commands (npx --yes patch-package, npx ng build) are used to run build tools from locally installed npm packages in a project-owned source tree; this is standard practice in Node.js projects and does not execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:104 npx --yes patch-package
  • PKGBUILD:106 npx ng build --base-href ./

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=yet-another-electron-term
3_pkgname=YAET
4pkgver=7.5.0
5_electronversion=41
6_nodeversion=24
7pkgrel=1
8pkgdesc="All-in-one remote connection manager. SSH/Telnet/WinRM/Serial terminals, SCP/FTP/SMB/WebDav/S3 file explorer, VNC/SPICE/RDP remote desktop."
9arch=('any')
10url="https://github.com/invince/YAET"
11license=('Apache-2.0')
12depends=(
13 "electron${_electronversion}"
14 'python'
15 'libsecret'
16 'nodejs'
17)
18makedepends=(
19 'npm'
20 'nvm'
21 'git'
22 'gendesk'
23 'jq'
24)
25source=(
26 "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
27 "${pkgname}.sh"
28)
29sha256sums=('ea8f5504a5f95b80ae945688d28e92ce7de29f4a07264f1357459bc3c5366eca'
30 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
31_get_project_dir() {
32 local d
33 while IFS= read -r d; do
34 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
35 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
36}
37_ensure_local_nvm() {
38 local NVM_DIR="${srcdir}/.nvm"
39 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
40 nvm install "${_nodeversion}"
41 nvm use "${_nodeversion}"
42}
43_get_app_dir() {
44 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
45 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
46}
47_get_electron_version() {
48 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
49 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
50 | grep -oE '[0-9]+' | head -1)
51 [[ -z "${_elec_ver}" ]] && return 1
52 (( _elec_ver == _electronversion )) && c=32 || c=31
53 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
54}
55_set_build_env() {
56 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
57 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
58 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
59 export ELECTRON_BUILDER_OFFLINE=true
60 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
61 export HOME="${srcdir}/.home"
62 export XDG_CACHE_HOME="${HOME}/.cache"
63 export XDG_CONFIG_HOME="${HOME}/.config"
64 export XDG_DATA_HOME="${HOME}/.local/share"
65 export npm_config_cache="${HOME}/.npm_cache"
66 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
67 export COREPACK_HOME="${HOME}/.corepack"
68 export npm_config_audit=false
69 export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
70 mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
71}
72prepare() {
73 cd "$(_get_project_dir)"
74 _get_electron_version
75 sed -i -e "
76 s/@electronversion@/${_electronversion}/g
77 s/@appname@/${pkgname}/g
78 " "${srcdir}/${pkgname}.sh"
79 gendesk -q -f -n \
80 --pkgname="${pkgname}" \
81 --pkgdesc="${pkgdesc}" \
82 --categories="Utility;System" \
83 --name="${_pkgname}" \
84 --exec="${pkgname} %U"
85 _ensure_local_nvm
86 _set_build_env
87 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
88 sed -i -e "
89 /const path = require(\"path\");/a \\
90 const os = require('os');\nconst configHome = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
91 s|const logPath = \`\${__dirname}/logs/main.log\`;|const logPath = path.join(configHome, '${pkgname}', 'logs', 'main.log');|
92 " src-electron/electronMain.js
93 export NODE_ENV=development
94 npm install
95}
96build() {
97 cd "$(_get_project_dir)"
98 _ensure_local_nvm
99 _set_build_env
100 export NODE_ENV=production
101 export NG_CLI_ANALYTICS=false
102 export CI=true
103 npm run clean
104 npx --yes patch-package
105 node scripts/generate-plugin-barrel.js
106 npx ng build --base-href ./
107 npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
108 local _archrem=$([[ "${CARCH}" == "aarch64" ]] && echo x64 || echo arm)
109 find "$(_get_app_dir)" -type d \
110 \( -name 'darwin*' -o -name '*android*' -o -name 'win32*' -o -name "*${_archrem}*" \) \
111 -prune -exec rm -rf {} +
112 rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
113}
114package() {
115 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
116 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
117 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
118 install -Dm644 "$(_get_project_dir)/src-electron/assets/icons/app-icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
119 install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
120 install -Dm644 "$(_get_project_dir)/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}"
121}
122

Changes since previous scan

--- PKGBUILD @ 2026-10-14 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=yet-another-electron-term
_pkgname=YAET
-pkgver=7.4.9
+pkgver=7.5.0
_electronversion=41
_nodeversion=24
pkgrel=1
@@ -26,22 +26,31 @@
"${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
"${pkgname}.sh"
)
-sha256sums=('b634c6ba1df545caf8c180d5333555af2d9af31969b090f2139e7a5b4826da92'
- 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
-_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
-}
+sha256sums=('ea8f5504a5f95b80ae945688d28e92ce7de29f4a07264f1357459bc3c5366eca'
+ 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
_get_project_dir() {
local d
while IFS= read -r d; do
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
}
+_ensure_local_nvm() {
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
+}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
+}
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
@@ -60,21 +69,12 @@
export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
}
-_get_electron_version() {
- _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
- | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
- | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
-}
prepare() {
cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${_pkgname}/g
" "${srcdir}/${pkgname}.sh"
gendesk -q -f -n \
--pkgname="${pkgname}" \
@@ -82,9 +82,9 @@
--categories="Utility;System" \
--name="${_pkgname}" \
--exec="${pkgname} %U"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
sed -i -e "
/const path = require(\"path\");/a \\
const os = require('os');\nconst configHome = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
@@ -95,8 +95,8 @@
}
build() {
cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
export NODE_ENV=production
export NG_CLI_ANALYTICS=false
export CI=true
@@ -105,25 +105,18 @@
node scripts/generate-plugin-barrel.js
npx ng build --base-href ./
npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
- local _app_dir="$(_get_app_dir)"
- find "${_app_dir}/resources" -type d -exec chmod 755 {} +
- case "${CARCH}" in
- aarch64) _archrem=x64 ;;
- x86_64) _archrem=arm ;;
- esac
- find "${_app_dir}/resources/app.asar.unpacked" -type d \
- \( -name "darwin*" -o -name "win32*" -o -name "*${_archrem}"* \) \
- -exec rm -rf {} +
+ local _archrem=$([[ "${CARCH}" == "aarch64" ]] && echo x64 || echo arm)
+ find "$(_get_app_dir)" -type d \
+ \( -name 'darwin*' -o -name '*android*' -o -name 'win32*' -o -name "*${_archrem}*" \) \
+ -prune -exec rm -rf {} +
+ rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _app_dir="$(_get_app_dir)"
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
- rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
- local _src="$(_get_project_dir)"
- install -Dm644 "${_src}/src-electron/assets/icons/app-icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
- install -Dm644 "${_src}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${_src}/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
+ install -Dm644 "$(_get_project_dir)/src-electron/assets/icons/app-icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
+ install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 23:21:11 Medium 1
2026-10-14 00:06:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion