18xx-maker-git 1.0.0.beta.138.r0.gbba4dac-1
🚂 Prototyping tool for 18xx games 💸.
config.json file.
/v1/packages/18xx-maker-git/versions SHAs are authoritative.
Metadata
Relations
Depends
Make dependencies
Conflicts
Provides
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| 9ff8fc5260dahead | verified | 2026-11-05 16:03 | 22 |
| 23c773de4396 | verified | 2026-11-05 16:10 | 17 |
| 5ecdd35def44 | verified | 2026-11-05 16:02 | 11 |
Head findings
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
cd "$(_get_project_dir)"
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
risky-tool
in
PKGBUILD'nvm' is invoked - this fetches/executes external code outside alpm's control.
nvm install "${_nodeversion}"risky-tool
in
PKGBUILD'nvm' is invoked - this fetches/executes external code outside alpm's control.
nvm use "${_nodeversion}"command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
local _pkgjson="$(_get_project_dir)/package.json"
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"risky-tool
in
PKGBUILD'npm' is invoked - this fetches/executes external code outside alpm's control.
npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
cd "$(_get_project_dir)"
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm install
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
cd "$(_get_project_dir)"
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm run build:app
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
rm -rf "$(_get_app_dir)/resources/default_app.asar"
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
install -Dm644 "$(_get_project_dir)/dist/app/linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
install -Dm644 "$(_get_project_dir)/electron/assets/${pkgname%-git}.png" -t "${pkgdir}/usr/share/pixmaps"command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.