youtube-dl-gui
LOW
maintainer JasonLandbridge
3 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npx command is used to run electron-builder locally during the build process, which is a standard part of building Electron applications and does not execute untrusted remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command is used to run electron-builder locally during the build process, which is a standard part of building Electron applications and does not execute untrusted remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:28
npx electron-builder --linux tar.xz --config ../../electron-builder.yml
PKGBUILD
1 offending line(s) highlighted
1
pkgname=youtube-dl-gui
2
_pkgname=youtube-dl-gui
3
pkgver=2.5.7
4
pkgrel=1
5
pkgdesc='[StefanLobbenmeier/youtube-dl-gui] A cross-platform GUI for youtube-dl made in Electron and node.js'
6
arch=('x86_64')
7
license=('AGPL3')
8
depends=('python-mutagen')
9
makedepends=('git' 'nodejs' 'npm')
10
url="https://github.com/StefanLobbenmeier/youtube-dl-gui"
11
options=('!strip')
12
source=("https://github.com/StefanLobbenmeier/${pkgname}/archive/refs/tags/v${pkgver}.tar.gz"
13
"Square150x150Logo.png::https://raw.githubusercontent.com/StefanLobbenmeier/${pkgname}/master/build/appx/Square150x150Logo.png"
14
"Square44x44Logo.png::https://raw.githubusercontent.com/StefanLobbenmeier/${pkgname}/master/build/appx/Square44x44Logo.png"
15
"StoreLogo.png::https://raw.githubusercontent.com/StefanLobbenmeier/${pkgname}/master/build/appx/StoreLogo.png")
16
md5sums=('3be7b8b182ccd96e48989b4e57311193'
17
'SKIP'
18
'SKIP'
19
'SKIP')
20
21
prepare() {
22
cd ${srcdir}/${pkgname}-${pkgver}
23
npm install
24
}
25
26
build() {
27
cd ${pkgname}-${pkgver}
28
npx electron-builder --linux tar.xz --config ../../electron-builder.yml
29
}
30
31
package() {
32
mkdir -p ${pkgdir}/opt
33
mkdir -p ${pkgdir}/usr/bin
34
35
tar -xf ${srcdir}/${pkgname}-${pkgver}/dist/${pkgname}-${pkgver}.tar.xz -C $pkgdir/opt
36
mv ${pkgdir}/opt/${pkgname}-${pkgver} ${pkgdir}/opt/${pkgname}
37
install -Dm644 ../${pkgname}.desktop "${pkgdir}/usr/share/applications/${pkgname}.desktop"
38
install -Dm644 ${srcdir}/${pkgname}-${pkgver}/renderer/img/icon.png "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/${pkgname}.png"
39
40
# Install appx icons at standard Linux icon sizes
41
install -Dm644 "${srcdir}/Square44x44Logo.png" "${pkgdir}/usr/share/icons/hicolor/48x48/apps/${pkgname}.png"
42
install -Dm644 "${srcdir}/StoreLogo.png" "${pkgdir}/usr/share/icons/hicolor/64x64/apps/${pkgname}.png"
43
install -Dm644 "${srcdir}/Square150x150Logo.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${pkgname}.png"
44
45
ln -fs /opt/${pkgname}/${pkgname} ${pkgdir}/usr/bin/${pkgname}
46
}
47
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |