zalo-for-linux-git

LOW

maintainer nanoka 1 votes scanned 2026-10-25 00:20:48.567348

View on AUR

Why flagged

The npx command is used to run prebuild-install for sqlite3, which is a legitimate build step to fetch a prebuilt binary; it does not execute arbitrary remote code or introduce untrusted dependencies.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command is used to run prebuild-install for sqlite3, which is a legitimate build step to fetch a prebuilt binary; it does not execute arbitrary remote code or introduce untrusted dependencies.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:92 (cd node_modules/sqlite3 && npx prebuild-install -r napi)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nguyen Hoang Ky <nhktmdzhg at gmail dot com>
    
      2pkgname=zalo-for-linux-git
    
      3pkgdesc="Zalo for Linux — unofficial port with ZaDark, running on system Electron 22"
    
      4arch=('x86_64' 'aarch64')
    
      5url="https://github.com/doandat943/zalo-for-linux"
    
      6license=('MIT')
    
      7pkgver=26.10.11+26.2.1.r183.285ba91
    
      8pkgrel=1
    
      9epoch=2
    
      10provides=('zalo')
    
      11conflicts=('zalo' 'zalo-for-linux-bin')
    
      12
    
      13depends=(
    
      14    'electron22-bin'
    
      15    'glibc'
    
      16    'xz'
    
      17    'openssl'
    
      18    'hicolor-icon-theme'
    
      19    'python'
    
      20    'opus'
    
      21    'libpulse'
    
      22    'alsa-utils'
    
      23    'pipewire'
    
      24    'rtkit'
    
      25)
    
      26
    
      27makedepends=(
    
      28    'git' 'nodejs' 'npm' 'make'
    
      29    'gcc' '7zip' 'rust' 'wget'
    
      30)
    
      31
    
      32optdepends=(
    
      33    'wl-clipboard: paste images from clipboard on Wayland'
    
      34    'xclip: paste images from clipboard on X11'
    
      35    'deepin-screen-recorder: Screenshot without/with Zalo window button'
    
      36    'spectacle: Screenshot without/with Zalo window button'
    
      37    'flameshot: Screenshot without/with Zalo window button'
    
      38    'gnome-screenshot: Screenshot without/with Zalo window button'
    
      39    'xfce4-screenshooter: Screenshot without/with Zalo window button'
    
      40    'mate-utils: Screenshot without/with Zalo window button'
    
      41    'cosmic-screenshot: Screenshot without/with Zalo window button'
    
      42    'scrot: Screenshot without/with Zalo window button'
    
      43    'zenity: call window when the engine is run standalone'
    
      44)
    
      45
    
      46options=(!emptydirs !debug)
    
      47
    
      48source=(
    
      49    "$pkgname::git+https://github.com/doandat943/zalo-for-linux.git"
    
      50    "integrate-zadark.js"
    
      51    "zalo.sh"
    
      52    "zalo.desktop"
    
      53)
    
      54sha256sums=(
    
      55    'SKIP'
    
      56    'bda3e47be9cb7a9707bed0e6c1344b32abe67a6c85de6538521223d59fa998de'
    
      57    '277f7b54fc65deb7d524537ac73a110c23aab771aabff092d19c114abd305c91'
    
      58    '9c692898a06c7d311e1cd2cbe53a4b0a0e5b46a42c69c8320318dce12d48bb47'
    
      59)
    
      60
    
      61pkgver() {
    
      62    local _src="$srcdir/$pkgname"
    
      63    if [[ ! -d $_src/.git ]]; then
    
      64        echo 'git source not extracted yet; run makepkg -o first' >&2
    
      65        return 1
    
      66    fi
    
      67    cd "$_src"
    
      68    git submodule update --init --recursive plugins/zadark >&2
    
      69    local _zadark
    
      70    _zadark=$(sed -n 's/.*"version": *"\([^"]*\)".*/\1/p' plugins/zadark/package.json | head -1)
    
      71    local _zalo
    
      72    _zalo=$(git describe --tags --abbrev=0)
    
      73    printf '%s+%s.r%s.%s' "$_zalo" "$_zadark" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      74}
    
      75
    
      76prepare() {
    
      77    cd "$srcdir/$pkgname"
    
      78    git submodule update --init --recursive
    
      79}
    
      80
    
      81build() {
    
      82    cd "$srcdir/$pkgname"
    
      83    
    
      84    # Zalo version = repo's latest tag, same number as the DMG on zadn.vn
    
      85    export ZALO_VERSION="$(git describe --tags --abbrev=0)"
    
      86    export ZADARK_VERSION="$(node -p "require('./plugins/zadark/package.json').version")"
    
      87    
    
      88    # npm >= 12 blocks git deps (crx in zadark's lockfile) — allow-git=all
    
      89    # scripts skipped, so fetch sqlite3's N-API v6 prebuilt manually
    
      90    export npm_config_allow_git="all"
    
      91    npm ci --ignore-scripts --no-audit --no-fund
    
      92    (cd node_modules/sqlite3 && npx prebuild-install -r napi)
    
      93    
    
      94    node scripts/download.js
    
      95    node scripts/prepare-zadark.js
    
      96    node scripts/prepare-app.js
    
      97    node scripts/clean-unused.js
    
      98    node "$srcdir/integrate-zadark.js"
    
      99}
    
      100
    
      101package() {
    
      102    cd "$srcdir/$pkgname"
    
      103    local _lib="$pkgdir/usr/lib/zalo"
    
      104    
    
      105    install -d "$_lib" "$_lib/plugins"
    
      106    cp -a main.js package.json app zcall-native plugins "$_lib/"
    
      107    # ps-list's vendored Windows exes are unused on Linux (reads /proc).
    
      108    find "$_lib/plugins/zadark" -type f \( -name '*.exe' -o -name '*.dylib' \
    
      109    -o -name '*.dll' \) -delete
    
      110    rm -rf "$_lib/plugins/zadark/node_modules"
    
      111    find "$_lib" -type d -name __pycache__ -prune -exec rm -rf {} +
    
      112    find "$_lib" -type f -name '*.pyc' -delete
    
      113    # gulp in the zadark submodule leaves the o+w bit; packages must not be world-writable
    
      114    chmod -R o-w "$_lib"
    
      115    
    
      116    install -Dm755 "$srcdir/zalo.sh" "$pkgdir/usr/bin/zalo"
    
      117    install -Dm644 "$srcdir/zalo.desktop" "$pkgdir/usr/share/applications/zalo.desktop"
    
      118    install -Dm644 app/pc-dist/favicon-512x512.png \
    
      119    "$pkgdir/usr/share/icons/hicolor/512x512/apps/zalo.png"
    
      120    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      121}
    
      122

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-10-25 00:20
@@ -4,9 +4,9 @@
 arch=('x86_64' 'aarch64')
 url="https://github.com/doandat943/zalo-for-linux"
 license=('MIT')
-pkgver=26.8.20+26.2.1.r99.87b0696
+pkgver=26.10.11+26.2.1.r183.285ba91
 pkgrel=1
-epoch=1
+epoch=2
 provides=('zalo')
 conflicts=('zalo' 'zalo-for-linux-bin')
 
@@ -16,13 +16,17 @@
     'xz'
     'openssl'
     'hicolor-icon-theme'
+    'python'
+    'opus'
+    'libpulse'
+    'alsa-utils'
+    'pipewire'
+    'rtkit'
 )
 
 makedepends=(
-    'git' 'nodejs' 'npm' 'python' 'make'
+    'git' 'nodejs' 'npm' 'make'
     'gcc' '7zip' 'rust' 'wget'
-    'mingw-w64-gcc'
-    'lib32-gcc-libs' 'lib32-glibc' 'lib32-libx11' 'lib32-libxcb' 'lib32-libxext'
 )
 
 optdepends=(
@@ -33,21 +37,10 @@
     'flameshot: Screenshot without/with Zalo window button'
     'gnome-screenshot: Screenshot without/with Zalo window button'
     'xfce4-screenshooter: Screenshot without/with Zalo window button'
-    'mate-screenshot: Screenshot without/with Zalo window button'
+    'mate-utils: Screenshot without/with Zalo window button'
+    'cosmic-screenshot: Screenshot without/with Zalo window button'
     'scrot: Screenshot without/with Zalo window button'
-    'wine: Voice/Video call engine support (or download portable wine in-app)'
-    'v4l-utils: control camera formats (fix inverted/green camera)'
-    'v4l2loopback-dkms: loopback camera support'
-    'xorg-server-xvfb: headless X server for Wayland screen-sharing bridge'
-    'python-dbus: required by the Wayland screen-sharing bridge (zcall-bridge/screenbridge.py)'
-    'python: required by the Wayland screen-sharing bridge (screenbridge.py)'
-    'xdotool: window resizing for screen bridge display'
-    'gst-plugins-base: 64-bit GStreamer plugins (ximagesink) for screen bridge'
-    'gst-plugins-bad: 64-bit GStreamer plugins (pipewiresrc) for screen bridge'
-    'python-gobject: required by the Wayland screen-sharing bridge (zcall-bridge/screenbridge.py)'
-    'lib32-glibc: 32-bit runtime for the Wayland screen-share shim (zcall-bridge/streamproxy.so, pulled in by wine)'
-    'lib32-libx11: 32-bit X11 for the Wayland screen-share shim (pulled in by wine)'
-    'lib32-libxcb: 32-bit XCB for the Wayland screen-share shim (pulled in by wine)'
+    'zenity: call window when the engine is run standalone'
 )
 
 options=(!emptydirs !debug)
@@ -60,7 +53,7 @@
 )
 sha256sums=(
     'SKIP'
-    'd88b81e287f303e0824b37a9778f92c223ff946b31c81c699e9fde3fe436b762'
+    'bda3e47be9cb7a9707bed0e6c1344b32abe67a6c85de6538521223d59fa998de'
     '277f7b54fc65deb7d524537ac73a110c23aab771aabff092d19c114abd305c91'
     '9c692898a06c7d311e1cd2cbe53a4b0a0e5b46a42c69c8320318dce12d48bb47'
 )
@@ -90,7 +83,6 @@
     
     # Zalo version = repo's latest tag, same number as the DMG on zadn.vn
     export ZALO_VERSION="$(git describe --tags --abbrev=0)"
-    export ZALO_WIN_VERSION="$ZALO_VERSION"
     export ZADARK_VERSION="$(node -p "require('./plugins/zadark/package.json').version")"
     
     # npm >= 12 blocks git deps (crx in zadark's lockfile) — allow-git=all
@@ -99,14 +91,10 @@
     npm ci --ignore-scripts --no-audit --no-fund
     (cd node_modules/sqlite3 && npx prebuild-install -r napi)
     
-    node scripts/download-dmg.js
+    node scripts/download.js
     node scripts/prepare-zadark.js
-    node scripts/prepare-app.js    
-    node scripts/setup-zcall-bridge.js
-    test -f app/native/qt-call-and-cap/pipebridge.exe || {
-        echo 'ERROR: call engine missing (qt-call-and-cap/pipebridge.exe) — Windows installer download failed' >&2
-        return 1
-    }
+    node scripts/prepare-app.js
+    node scripts/clean-unused.js
     node "$srcdir/integrate-zadark.js"
 }
 
@@ -115,16 +103,13 @@
     local _lib="$pkgdir/usr/lib/zalo"
     
     install -d "$_lib" "$_lib/plugins"
-    # Strip Mach-O/PE natives from the DMG: Linux bindings always sit under a
-    # path containing "linux"; keep qt-call-and-cap (the Wine call engine).
-    find app/native/nativelibs -type f \( -name '*.node' -o -name '*.dylib' \
-    -o -name '*.exe' -o -name '*.dll' \) ! -path '*linux*' -delete
-    find app/native/nativelibs -type d -empty -delete
-    cp -a main.js package.json app zcall-bridge plugins "$_lib/"
+    cp -a main.js package.json app zcall-native plugins "$_lib/"
     # ps-list's vendored Windows exes are unused on Linux (reads /proc).
     find "$_lib/plugins/zadark" -type f \( -name '*.exe' -o -name '*.dylib' \
     -o -name '*.dll' \) -delete
     rm -rf "$_lib/plugins/zadark/node_modules"
+    find "$_lib" -type d -name __pycache__ -prune -exec rm -rf {} +
+    find "$_lib" -type f -name '*.pyc' -delete
     # gulp in the zadark submodule leaves the o+w bit; packages must not be world-writable
     chmod -R o-w "$_lib"
     

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 17:16:11	Medium	1
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2