ytm-dlp-gui
maintainer zxp19821005
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The npm install runs during build from the project's own source (git checkout), which is normal for Electron apps; the flagged external package install is part of the legitimate build process using declared dependencies, not an undeclared remote code execution.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install runs during build from the project's own source (git checkout), which is normal for Electron apps; the flagged external package install is part of the legitimate build process using declared dependencies, not an undeclared remote code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:74
NODE_ENV=development npm add -D @electron-forge/plugin-local-electron
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=ytm-dlp-gui
3
_pkgname=YTM-DLP-GUI
4
pkgver=1.3.4
5
_electronversion=26
6
_nodeversion=20
7
pkgrel=5
8
pkgdesc="An ElectronJS app for downloading music off Youtube Music.(Use system-wide electron)"
9
arch=('any')
10
url="https://github.com/RENOMIZER/ytm-dlp-gui"
11
license=('MIT')
12
conflicts=("${pkgname}")
13
depends=(
14
"electron${_electronversion}"
15
)
16
makedepends=(
17
'gendesk'
18
'npm'
19
'nvm'
20
'curl'
21
'git'
22
)
23
source=(
24
"${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}"
25
"${pkgname}.sh"
26
)
27
sha256sums=('c134205a5a0ef631884dc9ea7584e69bb37cd36a2e89fdaaef7ef648430d8ff1'
28
'31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
29
_ensure_local_nvm() {
30
local NVM_DIR="${srcdir}/.nvm"
31
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
32
nvm install "${_nodeversion}"
33
nvm use "${_nodeversion}"
34
}
35
_get_electron_version() {
36
_elec_ver="$(grep -m 1 '"electron":' "${srcdir}/${pkgname}-${pkgver}/package.json" | cut -d'"' -f4 | tr -d '^' | cut -d. -f1)"
37
echo -e "The electron version is: \033[1;31m${_elec_ver}\033[0m"
38
}
39
prepare() {
40
cd "${srcdir}/${pkgname}-${pkgver}"
41
_get_electron_version
42
sed -i -e "
43
s/@electronversion@/${_electronversion}/g
44
s/@appname@/${pkgname}/g
45
s/@runname@/app.asar/g
46
s/@cfgdirname@/${pkgname}/g
47
s/@options@//g
48
" "${srcdir}/${pkgname}.sh"
49
_ensure_local_nvm
50
gendesk -q -f -n \
51
--pkgname="${pkgname}" \
52
--pkgdesc="${pkgdesc}" \
53
--categories="Utility" \
54
--name="${pkgname}" \
55
--exec="${pkgname} %U"
56
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
57
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
58
HOME="${srcdir}/.electron-gyp"
59
{
60
echo -e '\n'
61
#echo 'build_from_source=true'
62
echo "cache=${srcdir}/.npm_cache"
63
} >> .npmrc
64
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
65
{
66
echo 'registry=https://registry.npmmirror.com'
67
echo 'disturl=https://registry.npmmirror.com/-/binary/node/'
68
echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
69
} >> .npmrc
70
find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
71
fi
72
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
73
NODE_ENV=development npm install
74
NODE_ENV=development npm add -D @electron-forge/plugin-local-electron
75
}
76
build() {
77
cd "${srcdir}/${pkgname}-${pkgver}"
78
local electronDist="/usr/lib/electron${_electronversion}"
79
sed -i -e "/^[[:space:]]*plugins:[[:space:]]*\[.*\$/a\\
80
{\\
81
name: \"@electron-forge/plugin-local-electron\",\\
82
config: {\\
83
electronPath: \"${electronDist}\"\\
84
}\\
85
}," forge.config.*
86
NODE_ENV=production npm run package
87
}
88
package() {
89
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
90
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/out/${_pkgname}-linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname}"
91
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
92
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/src/images/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
93
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
94
}
95
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |