bitwarden-cli-git
LOW
maintainer eclairevoyant
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npm install in package() uses a locally built package from the git source, not an external download; the variable-named package is the project's own artifact, posing minimal supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install in package() uses a locally built package from the git source, not an external download; the variable-named package is the project's own artifact, posing minimal supply-chain risk.
-
PKGBUILD:48
npm install --production -g --prefix "$pkgdir"/usr $(npm pack . | tail -1)
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:48
npm install --production -g --prefix "$pkgdir"/usr $(npm pack . | tail -1)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: éclairevoyant
2
# Contributor: Alexander Epaneshnikov <alex19ep at archlinux dot com>
3
# Contributor: libertylocked <libertylocked at disroot dot org>
4
5
_pkgname=bitwarden-cli
6
pkgname="$_pkgname-git"
7
pkgver=2024.2.2.r100.b37ba717122
8
pkgrel=1
9
pkgdesc='Bitwarden Command-line Interface'
10
arch=(x86_64)
11
url='https://github.com/bitwarden/clients/tree/master/apps/cli'
12
license=(GPL3)
13
depends=(nodejs-lts-hydrogen)
14
makedepends=(git npm modclean)
15
provides=("$_pkgname")
16
conflicts=("$_pkgname")
17
options=(!emptydirs)
18
source=("$_pkgname::git+https://github.com/bitwarden/clients.git")
19
b2sums=('SKIP')
20
21
prepare() {
22
cd $_pkgname
23
export npm_config_build_from_source=true
24
export npm_config_cache="$srcdir/npm_cache"
25
26
npm ci
27
}
28
29
pkgver() {
30
cd $_pkgname
31
git blame -s -L"/\"version\"/,+1" apps/cli/package.json | awk '{
32
ver = gensub(/[^0-9.]/, "", "g", $4);
33
"git rev-list --count "$1"..HEAD" | getline commit_count;
34
print ver".r"commit_count"."$1
35
}'
36
}
37
38
build() {
39
cd $_pkgname/apps/cli
40
export npm_config_cache="$srcdir/npm_cache"
41
npm run dist:lin
42
npm run clean
43
node ./build/bw.js completion --shell zsh > _bw
44
}
45
46
package() {
47
cd $_pkgname/apps/cli
48
npm install --production -g --prefix "$pkgdir"/usr $(npm pack . | tail -1)
49
50
# Non-deterministic race in npm gives 777 permissions to random directories.
51
# See https://github.com/npm/npm/issues/9359 for details.
52
chmod -R u=rwX,go=rX "$pkgdir"
53
# npm gives ownership of ALL FILES to build user
54
# https://bugs.archlinux.org/task/63396
55
chown -R root:root "${pkgdir}"
56
57
# package zsh completions
58
install -vDm644 _bw -t "${pkgdir}/usr/share/zsh/site-functions"
59
60
# cleanup
61
sed -e "s|${srcdir}|/|" -i "$pkgdir"/usr/lib/node_modules/@bitwarden/cli/package.json
62
find "$pkgdir"/usr/lib/node_modules -name 'package.json' -exec sed -e "s|${srcdir}||" -i {} \;
63
modclean --path "$pkgdir"/usr/lib -r -a "*.ts,.bin,.github,.vscode,bin.js" --ignore='license'
64
}
65
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |