yet-another-electron-term
LOW
maintainer zxp19821005
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npx commands (patch-package, ng build, electron-builder) are used to build the project from its own source code and are not executing arbitrary remote code; this is standard in Node.js-based builds and poses minimal risk when building from a verified git tag.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx commands (patch-package, ng build, electron-builder) are used to build the project from its own source code and are not executing arbitrary remote code; this is standard in Node.js-based builds and poses minimal risk when building from a verified git tag.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:95
echo N | NODE_ENV=production npx patch-package -
PKGBUILD:96
NODE_ENV=production npx ng build --base-href ./
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=yet-another-electron-term
3
_pkgname=YAET
4
pkgver=7.4.1
5
_electronversion=39
6
_nodeversion=22
7
pkgrel=1
8
pkgdesc="All-in-one remote connection manager. SSH/Telnet/WinRM/Serial terminals, SCP/FTP/SMB/WebDav/S3 file explorer, VNC/SPICE/RDP remote desktop."
9
arch=('any')
10
url="https://github.com/invince/YAET"
11
license=('Apache-2.0')
12
depends=(
13
"electron${_electronversion}"
14
'python'
15
'libsecret'
16
)
17
makedepends=(
18
'npm'
19
'nvm'
20
'git'
21
'curl'
22
'gendesk'
23
'jq'
24
)
25
source=(
26
"${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}"
27
"${pkgname}.sh"
28
)
29
sha256sums=('4889a96e57018ad0aee9f09fbe0899f7375444afc042d8fded199eed86bb6275'
30
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
31
_ensure_local_nvm() {
32
local NVM_DIR="${srcdir}/.nvm"
33
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
34
nvm install "${_nodeversion}"
35
nvm use "${_nodeversion}"
36
}
37
_get_app_dir() {
38
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
39
}
40
_set_build_env() {
41
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
42
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
43
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
44
export HOME="${srcdir}/.electron-gyp"
45
export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
46
export NPM_CONFIG_MAXSOCKETS=32
47
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
48
{
49
export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
50
export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
51
export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
52
export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
53
export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
54
export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
55
}
56
find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
57
fi
58
}
59
_get_electron_version() {
60
_elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
61
-exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
62
[[ -z "${_elec_ver}" ]] && return 1
63
echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
64
}
65
prepare() {
66
cd "${srcdir}/${pkgname}-${pkgver}"
67
_get_electron_version
68
sed -i -e "
69
s/@electronversion@/${_electronversion}/g
70
s/@appname@/${pkgname}/g
71
s/@runname@/app.asar/g
72
s/@cfgdirname@/${_pkgname}/g
73
" "${srcdir}/${pkgname}.sh"
74
gendesk -q -f -n \
75
--pkgname="${pkgname}" \
76
--pkgdesc="${pkgdesc}" \
77
--categories="Utility;System" \
78
--name="${_pkgname}" \
79
--exec="${pkgname} %U"
80
_set_build_env
81
_ensure_local_nvm
82
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
83
sed -i -e "
84
/const path = require(\"path\");/a \\
85
const os = require('os');\nconst configHome = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
86
s|const logPath = \`\${__dirname}/logs/main.log\`;|const logPath = path.join(configHome, '${pkgname}', 'logs', 'main.log');|
87
" src-electron/electronMain.js
88
NODE_ENV=development npm install
89
}
90
build() {
91
cd "${srcdir}/${pkgname}-${pkgver}"
92
_set_build_env
93
_ensure_local_nvm
94
NODE_ENV=production npm run clean
95
echo N | NODE_ENV=production npx patch-package
96
NODE_ENV=production npx ng build --base-href ./
97
NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
98
}
99
package() {
100
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
101
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
102
local _app_dir=$(_get_app_dir)
103
cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname}/"
104
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/src-electron/assets/icons/app-icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
105
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
106
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}"
107
}
108
Changes since previous scan
--- PKGBUILD @ 2026-09-09 00:04+++ PKGBUILD @ 2026-09-17 00:27@@ -1,7 +1,7 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> pkgname=yet-another-electron-term _pkgname=YAET-pkgver=7.3.0+pkgver=7.4.1 _electronversion=39 _nodeversion=22 pkgrel=1@@ -26,7 +26,7 @@ "${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}" "${pkgname}.sh" )-sha256sums=('13308b2ee2a2eb99fc954115703c25735e7819e5feffae50de93278781676c4a'+sha256sums=('4889a96e57018ad0aee9f09fbe0899f7375444afc042d8fded199eed86bb6275' 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d') _ensure_local_nvm() { local NVM_DIR="${srcdir}/.nvm"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 05:18:57 | Medium | 1 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 07:13:50 | Medium | 1 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 13:50:58 | Medium | 1 |
| 2026-09-02 09:50:35 | Medium | 1 |
| 2026-09-02 00:02:31 | Low | 2 |