zima-linux-client

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command is used to run @electron/rebuild locally against already-installed dependencies, not to execute arbitrary remote code; the source is a git checkout from the project's official repository.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command is used to run @electron/rebuild locally against already-installed dependencies, not to execute arbitrary remote code; the source is a git checkout from the project's official repository.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:73 npx @electron/rebuild -v "$electron_version"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Your Name <your.email@example.com>
    
      2pkgname=zima-linux-client
    
      3pkgver=0.9.23
    
      4pkgrel=1
    
      5pkgdesc="Modern Desktop Client for ZimaOS with integrated ZeroTier and SMB management"
    
      6arch=('x86_64')
    
      7url="https://github.com/chicohaager/zima-linux-client"
    
      8license=('MIT')
    
      9depends=(
    
  'electron'
    
  'fuse2'
    
  'smbclient'
    
  'nss'
    
  'gtk3'
    
  'libxkbcommon'
    
  'libxcb'
    
  'libx11'
    
  'libxcomposite'
    
  'libxdamage'
    
  'libxext'
    
  'libxfixes'
    
  'libxrandr'
    
  'alsa-lib'
    
  'at-spi2-core'
    
  'libcups'
    
  'libdrm'
    
  'mesa'
    
  'libsecret'
    
  'nodejs'
    
      30)
    
      31makedepends=('npm' 'nodejs' 'git' 'libsecret' 'python')
    
      32install=zima-linux-client.install
    
      33source=(
    
  "git+https://github.com/chicohaager/zima-linux-client.git#tag=v${pkgver}"
    
  "zima-linux-client.sh"
    
  "zima-linux-client.desktop"
    
      37)
    
      38sha256sums=(
    
  'SKIP'
    
  'SKIP'
    
  'SKIP'
    
      42)
    
      43
    
      44build() {
    
  cd "$srcdir/$pkgname"
    
  
    
  # Install dependencies
    
  npm install
    
  
    
  # Build the application
    
  npm run build
    
      52}
    
      53
    
      54package() {
    
  cd "$srcdir/$pkgname"
    
  
    
  # Create directories
    
  install -dm755 "$pkgdir/usr/lib/$pkgname"
    
  install -dm755 "$pkgdir/usr/bin"
    
  install -dm755 "$pkgdir/usr/share/applications"
    
  install -dm755 "$pkgdir/usr/share/icons/hicolor/512x512/apps"
    
  install -dm755 "$pkgdir/usr/lib/$pkgname/resources"
    
  install -dm755 "$pkgdir/usr/lib/systemd/user"
    
  
    
  # Copy built files (preserve dist directory structure)
    
  cp -r dist "$pkgdir/usr/lib/$pkgname/"
    
  cp package.json "$pkgdir/usr/lib/$pkgname/"
    
  
    
  # Install production dependencies only and rebuild for electron
    
  cd "$pkgdir/usr/lib/$pkgname"
    
  npm install --omit=dev
    
  local electron_version=$(electron --version | sed 's/v//')
    
  npx @electron/rebuild -v "$electron_version"
    
  
    
  # Remove unnecessary files to reduce package size
    
  find "$pkgdir/usr/lib/$pkgname/node_modules" -name "*.md" -delete 2>/dev/null || true
    
  find "$pkgdir/usr/lib/$pkgname/node_modules" -name "*.ts" ! -name "*.d.ts" -delete 2>/dev/null || true
    
  find "$pkgdir/usr/lib/$pkgname/node_modules" -type d -name "test" -exec rm -rf {} + 2>/dev/null || true
    
  find "$pkgdir/usr/lib/$pkgname/node_modules" -type d -name "tests" -exec rm -rf {} + 2>/dev/null || true
    
  find "$pkgdir/usr/lib/$pkgname/node_modules" -type d -name "__tests__" -exec rm -rf {} + 2>/dev/null || true
    
  
    
  cd "$srcdir/$pkgname"
    
  
    
  # Copy ZeroTier binaries
    
  cp -r bin "$pkgdir/usr/lib/$pkgname/"
    
  
    
  # Copy resources
    
  cp -r resources/*.service "$pkgdir/usr/lib/$pkgname/resources/" 2>/dev/null || true
    
  cp -r resources/*.sh "$pkgdir/usr/lib/$pkgname/resources/" 2>/dev/null || true
    
  cp -r resources/copyright "$pkgdir/usr/lib/$pkgname/resources/" 2>/dev/null || true
    
  
    
  # Install icon
    
  install -Dm644 icon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
    
  
    
  # Install launcher script
    
  install -Dm755 "$srcdir/zima-linux-client.sh" "$pkgdir/usr/bin/$pkgname"
    
  
    
  # Install desktop file
    
  install -Dm644 "$srcdir/zima-linux-client.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
  
    
  # Install systemd user service
    
  install -Dm644 resources/zima-zerotier.service "$pkgdir/usr/lib/systemd/user/zima-zerotier.service"
    
  
    
  # Install license
    
  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      106}
    
      107

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2