audiobookshelf-git

maintainer Todoroki · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npm install in prepare() is for 'pkg', a build tool used to package the application, and is part of the normal build process from the project's own source; the package is built from a git checkout of the official repository, and no untrusted remote code is executed.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install in prepare() is for 'pkg', a build tool used to package the application, and is part of the normal build process from the project's own source; the package is built from a git checkout of the official repository, and no untrusted remote code is executed.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:39 npm install pkg

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kevin S <aur@eldenring.mozmail.com>
    
      2pkgname=audiobookshelf-git
    
      3pkgver=v2.2.23.r28.gd86a3b3d
    
      4pkgrel=1
    
      5pkgdesc="Self-hosted audiobook server for managing and playing audiobooks"
    
      6arch=('any')
    
      7url="https://github.com/advplyr/audiobookshelf"
    
      8license=('GPL3')
    
      9depends=('ffmpeg')
    
      10makedepends=('nodejs' 'npm' 'git')
    
      11optdepends=('tone-bin')
    
      12provides=("audiobookshelf")
    
      13conflicts=("audiobookshelf")
    
      14backup=('etc/conf.d/audiobookshelf')
    
      15options=(!strip)
    
      16
    
      17source=(${pkgname}::git+"${url}".git
    
      18	'audiobookshelf.conf.d'
    
      19	'audiobookshelf.hook'
    
      20	'audiobookshelf.service'
    
      21        'audiobookshelf.sysusers'
    
      22        'audiobookshelf.tmpfiles')
    
      23
    
      24md5sums=('SKIP'
    
      25	'de5fab845f7f96b49956c7dc21268593'
    
      26	'749322fc2b48a839a79a638d879e77a4'
    
      27	'ce89e5d2ce27de70b5e6b53cbaf595f0'
    
      28        '63619dfc5bb5b2dbecfb1d6037095338'
    
      29        '90e34ac4e5a79f71af3eaab8cebf1198')
    
      30
    
      31pkgver() {
    
      32	cd "$pkgname"
    
      33	git describe --long | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      34}
    
      35
    
      36prepare() {    
    
      37	cd "${srcdir}/${pkgname}"
    
      38	# install build dependencies
    
      39	npm install pkg
    
      40}
    
      41
    
      42build() {
    
      43	cd "${srcdir}/${pkgname}"
    
      44	echo ">>> Building Client"
    
      45	echo "--------------------"
    
      46
    
      47	cd client
    
      48	rm -rf node_modules
    
      49	npm ci --unsafe-perm=true --allow-root
    
      50	NODE_OPTIONS=--openssl-legacy-provider	npm run generate
    
      51	cd ..
    
      52
    
      53	echo ">>> Building Server"
    
      54	echo "--------------------"
    
      55
    
      56	rm -rf node_modules
    
      57	npm ci --unsafe-perm=true --allow-root
    
      58}
    
      59
    
      60package() {
    
      61	cd "${srcdir}/${pkgname}"
    
      62
    
      63	install -d -m 755 "${pkgdir}/usr/share/audiobookshelf/"
    
      64	"${srcdir}/${pkgname}"/node_modules/.bin/pkg -t node16-linux -o "${pkgdir}/usr/share/audiobookshelf/audiobookshelf" . 
    
      65	install -D -m 644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      66	install -D -m 644 "${srcdir}/audiobookshelf.conf.d" "${pkgdir}/etc/conf.d/audiobookshelf"
    
      67	install -D -m 644 "${srcdir}/audiobookshelf.service" "${pkgdir}/usr/lib/systemd/system/audiobookshelf.service"
    
      68	install -D -m 644 "${srcdir}/audiobookshelf.sysusers" "${pkgdir}/usr/lib/sysusers.d/audiobookshelf.conf"
    
      69	install -D -m 644 "${srcdir}/audiobookshelf.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/audiobookshelf.conf"
    
      70	install -D -m 644 "${srcdir}/audiobookshelf.hook" "${pkgdir}/usr/share/doc/${pkgname}/audiobookshelf.hook"
    
      71}
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2