zima-linux-client
LOW
maintainer orphaned
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npx command is used to run @electron/rebuild locally against already-installed dependencies, not to execute arbitrary remote code; the source is a git checkout from the project's official repository.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command is used to run @electron/rebuild locally against already-installed dependencies, not to execute arbitrary remote code; the source is a git checkout from the project's official repository.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:73
npx @electron/rebuild -v "$electron_version"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Your Name <your.email@example.com>
2
pkgname=zima-linux-client
3
pkgver=0.9.23
4
pkgrel=1
5
pkgdesc="Modern Desktop Client for ZimaOS with integrated ZeroTier and SMB management"
6
arch=('x86_64')
7
url="https://github.com/chicohaager/zima-linux-client"
8
license=('MIT')
9
depends=(
10
'electron'
11
'fuse2'
12
'smbclient'
13
'nss'
14
'gtk3'
15
'libxkbcommon'
16
'libxcb'
17
'libx11'
18
'libxcomposite'
19
'libxdamage'
20
'libxext'
21
'libxfixes'
22
'libxrandr'
23
'alsa-lib'
24
'at-spi2-core'
25
'libcups'
26
'libdrm'
27
'mesa'
28
'libsecret'
29
'nodejs'
30
)
31
makedepends=('npm' 'nodejs' 'git' 'libsecret' 'python')
32
install=zima-linux-client.install
33
source=(
34
"git+https://github.com/chicohaager/zima-linux-client.git#tag=v${pkgver}"
35
"zima-linux-client.sh"
36
"zima-linux-client.desktop"
37
)
38
sha256sums=(
39
'SKIP'
40
'SKIP'
41
'SKIP'
42
)
43
44
build() {
45
cd "$srcdir/$pkgname"
46
47
# Install dependencies
48
npm install
49
50
# Build the application
51
npm run build
52
}
53
54
package() {
55
cd "$srcdir/$pkgname"
56
57
# Create directories
58
install -dm755 "$pkgdir/usr/lib/$pkgname"
59
install -dm755 "$pkgdir/usr/bin"
60
install -dm755 "$pkgdir/usr/share/applications"
61
install -dm755 "$pkgdir/usr/share/icons/hicolor/512x512/apps"
62
install -dm755 "$pkgdir/usr/lib/$pkgname/resources"
63
install -dm755 "$pkgdir/usr/lib/systemd/user"
64
65
# Copy built files (preserve dist directory structure)
66
cp -r dist "$pkgdir/usr/lib/$pkgname/"
67
cp package.json "$pkgdir/usr/lib/$pkgname/"
68
69
# Install production dependencies only and rebuild for electron
70
cd "$pkgdir/usr/lib/$pkgname"
71
npm install --omit=dev
72
local electron_version=$(electron --version | sed 's/v//')
73
npx @electron/rebuild -v "$electron_version"
74
75
# Remove unnecessary files to reduce package size
76
find "$pkgdir/usr/lib/$pkgname/node_modules" -name "*.md" -delete 2>/dev/null || true
77
find "$pkgdir/usr/lib/$pkgname/node_modules" -name "*.ts" ! -name "*.d.ts" -delete 2>/dev/null || true
78
find "$pkgdir/usr/lib/$pkgname/node_modules" -type d -name "test" -exec rm -rf {} + 2>/dev/null || true
79
find "$pkgdir/usr/lib/$pkgname/node_modules" -type d -name "tests" -exec rm -rf {} + 2>/dev/null || true
80
find "$pkgdir/usr/lib/$pkgname/node_modules" -type d -name "__tests__" -exec rm -rf {} + 2>/dev/null || true
81
82
cd "$srcdir/$pkgname"
83
84
# Copy ZeroTier binaries
85
cp -r bin "$pkgdir/usr/lib/$pkgname/"
86
87
# Copy resources
88
cp -r resources/*.service "$pkgdir/usr/lib/$pkgname/resources/" 2>/dev/null || true
89
cp -r resources/*.sh "$pkgdir/usr/lib/$pkgname/resources/" 2>/dev/null || true
90
cp -r resources/copyright "$pkgdir/usr/lib/$pkgname/resources/" 2>/dev/null || true
91
92
# Install icon
93
install -Dm644 icon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
94
95
# Install launcher script
96
install -Dm755 "$srcdir/zima-linux-client.sh" "$pkgdir/usr/bin/$pkgname"
97
98
# Install desktop file
99
install -Dm644 "$srcdir/zima-linux-client.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
100
101
# Install systemd user service
102
install -Dm644 resources/zima-zerotier.service "$pkgdir/usr/lib/systemd/user/zima-zerotier.service"
103
104
# Install license
105
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
106
}
107
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |