Motrix - Moses Yebei

The Problem

Users need a desktop download manager that can handle HTTP, FTP, BitTorrent and Magnet links with a native UI on Windows, macOS and Linux. Existing managers often lack a single‑code‑base Electron implementation or expose a fragmented configuration surface.

What This Does

Motrix is an Electron‑based download manager built on the electron‑vue stack. Core logic lives under src/main/ (e.g., src/main/Application.js, src/main/core/Logger.js) while the UI lives under src/renderer/ (Vue components such as src/renderer/components/Preference/Advanced.vue). The build pipeline is driven by yarn and the electron-builder.json configuration, with CI defined in .travis.yml and GitHub Actions.

Key files:

src/main/index.js – boots the Electron main process.
src/renderer/api/Api.js – wraps the aria2 RPC client used for download control.
src/main/core/Engine.js – starts the bundled aria2 engine binaries found in extra/.

How It Is Wired

Execution starts at src/main/index.js, which creates an instance of src/main/Application.js. The Application constructor (src/main/Application.js:66) immediately calls init (10 calls) to set up context, config managers, and UI managers (Tray, Menu, Window).

init loads user and system config via src/main/utils/index.js:getUserConfig (called from 17 places) and src/main/utils/index.js:getSystemConfig (6 places). These config objects feed the src/main/core/Engine.js that spawns the bundled aria2 binary (extra/*/engine/aria2c*). The only outward‑facing operation is the file‑system open performed in src/main/Application.js → this.client.open (the sole external call).

The UI layer imports src/renderer/api/Api.js, which uses src/shared/aria2/lib/JSONRPCClient.js to issue JSON‑RPC commands over a local websocket to the engine. UI components such as Preference/Advanced.vue consume the API via src/renderer/components/CommandManager/index.js.

The most connected modules are:

src/main/core/Logger.js – 15 dependents, zero outgoing imports (instability 0).
src/main/Application.js – imports 18 other modules (instability 0.95).

No circular imports were detected, but deep nesting (indentation depth 11) appears in the Preference Vue files, making future changes risky.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/Motrix.git
cd Motrix

# Install dependencies
yarn install

# Build the Electron app (production)
yarn electron:build   # defined in package.json scripts via electron-builder

# Run locally (development)
yarn electron:start   # starts main and renderer processes with hot reload

Configuration files are located under src/main/configs/ (e.g., engine.js, protocol.js). The bundled aria2 binaries are in extra/ for each platform; no external download of aria2 is required.

Real‑World Use

A corporate IT desk can ship the built installer (dist/*.exe or .AppImage) to employee machines. When a user adds a torrent URL, the UI component calls Api.addUri, which forwards the request to the local aria2 engine via JSON‑RPC, stores the session file (/var/cache/aria2.session on Linux) and updates the UI through the Task Vue store (src/renderer/store/modules/task.js).

Code Health & Issues

High – Pin GitHub Actions – .github/workflows/* uses tag references (@v2). Replace with fixed commit SHAs.
High – No Test Suite – 415 source files, zero test files; add tests for each public entry point.
Medium – Least‑privilege GITHUB_TOKEN – .github/workflows/release.yml lacks a permissions block.
Medium – Enable Dependabot – No dependabot.yml present.
Medium – Dependency‑vulnerability gate – CI lacks a vulnerability scan step.
Medium – Large binaries in repo – extra/*/engine/aria2c* exceed 5 MiB; move to Git LFS or download at setup.
Medium – Remove generated build/ output – 12 generated files are version‑controlled.
Low – Set workflow timeouts – .github/workflows/codeql-analysis.yml has no timeout-minutes.

Additional observations: the repository contains a full CI configuration (Travis) but no unit or integration tests, and the LICENSE file is present.

The Bottom Line

Motrix delivers a complete Electron‑based download manager with a clear separation between core engine control and UI, but the codebase suffers from high‑impact hubs, deep nesting, and a lack of automated testing. It is suitable for teams comfortable extending Electron apps and willing to invest in test coverage and dependency hygiene.

What the analyser found

Deployment readiness

5/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

561 files

JavaScript371
Vue46
JSON10
Markdown9
YAML8
SCSS6

ReactVueExpress

Module dependencies

The 10 most depended-upon modules of 369, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_src_main_core_Logger["Logger"] n1_src_main_utils_index["index"] n2_src_main_ui_Locale["Locale"] n3_src_main_utils_menu["menu"] n4_tron_vue_webpack_main_config["webpack.main.config"] n5__vue_webpack_renderer_config["webpack.renderer.config"] n6_src_main_Application["Application"] n7_src_main_Launcher["Launcher"] n8_src_main_ui_TrayManager["TrayManager"] n9_src_main_core_Engine["Engine"] n6_src_main_Application --> n1_src_main_utils_index n6_src_main_Application --> n0_src_main_core_Logger n6_src_main_Application --> n2_src_main_ui_Locale n6_src_main_Application --> n9_src_main_core_Engine n6_src_main_Application --> n8_src_main_ui_TrayManager n7_src_main_Launcher --> n0_src_main_core_Logger n7_src_main_Launcher --> n6_src_main_Application n7_src_main_Launcher --> n1_src_main_utils_index n9_src_main_core_Engine --> n0_src_main_core_Logger n9_src_main_core_Engine --> n2_src_main_ui_Locale n9_src_main_core_Engine --> n1_src_main_utils_index n8_src_main_ui_TrayManager --> n0_src_main_core_Logger n8_src_main_ui_TrayManager --> n2_src_main_ui_Locale n8_src_main_ui_TrayManager --> n3_src_main_utils_menu n8_src_main_ui_TrayManager --> n1_src_main_utils_index n1_src_main_utils_index --> n0_src_main_core_Logger

Findings

MediumNo test files detected - untested code paths repository-wide

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium5

low1

Pin third-party GitHub Actions to a commit SHAhigh2 occurrences

.github/workflows

samuelmeuli/action-snapcraft@v2, motrixapp/action-electron-builder@v2

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Add a test suite; this repository has nonehigh415 occurrences

415 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/release.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

1 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium5 occurrences

extra/linux/x64/engine/aria2c

5 blobs over 5MB: aria2c 9.5MB, aria2c.exe 8.1MB, aria2c 8.1MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Remove generated build output from version controlmedium12 occurrences

build

12 generated files committed

The reviewer reads src, production runs dist, and a stale bundle means the fix that was reviewed is not the code that executes.

Fix: Gitignore the output directory and build in CI.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/codeql-analysis.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.