bitwarden-cli-git
LOW
maintainer eclairevoyant
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The npm install in package() uses a locally built package from the git source, not an external download; the variable-named package is the project's own artifact, posing minimal supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install in package() uses a locally built package from the git source, not an external download; the variable-named package is the project's own artifact, posing minimal supply-chain risk.
-
PKGBUILD:48
npm install --production -g --prefix "$pkgdir"/usr $(npm pack . | tail -1)
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:48
npm install --production -g --prefix "$pkgdir"/usr $(npm pack . | tail -1)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: éclairevoyant
2
# Contributor: Alexander Epaneshnikov <alex19ep at archlinux dot com>
3
# Contributor: libertylocked <libertylocked at disroot dot org>
4
5
_pkgname=bitwarden-cli
6
pkgname="$_pkgname-git"
7
pkgver=2024.2.2.r100.b37ba717122
8
pkgrel=1
9
pkgdesc='Bitwarden Command-line Interface'
10
arch=(x86_64)
11
url='https://github.com/bitwarden/clients/tree/master/apps/cli'
12
license=(GPL3)
13
depends=(nodejs-lts-hydrogen)
14
makedepends=(git npm modclean)
15
provides=("$_pkgname")
16
conflicts=("$_pkgname")
17
options=(!emptydirs)
18
source=("$_pkgname::git+https://github.com/bitwarden/clients.git")
19
b2sums=('SKIP')
20
21
prepare() {
22
cd $_pkgname
23
export npm_config_build_from_source=true
24
export npm_config_cache="$srcdir/npm_cache"
25
26
npm ci
27
}
28
29
pkgver() {
30
cd $_pkgname
31
git blame -s -L"/\"version\"/,+1" apps/cli/package.json | awk '{
32
ver = gensub(/[^0-9.]/, "", "g", $4);
33
"git rev-list --count "$1"..HEAD" | getline commit_count;
34
print ver".r"commit_count"."$1
35
}'
36
}
37
38
build() {
39
cd $_pkgname/apps/cli
40
export npm_config_cache="$srcdir/npm_cache"
41
npm run dist:lin
42
npm run clean
43
node ./build/bw.js completion --shell zsh > _bw
44
}
45
46
package() {
47
cd $_pkgname/apps/cli
48
npm install --production -g --prefix "$pkgdir"/usr $(npm pack . | tail -1)
49
50
# Non-deterministic race in npm gives 777 permissions to random directories.
51
# See https://github.com/npm/npm/issues/9359 for details.
52
chmod -R u=rwX,go=rX "$pkgdir"
53
# npm gives ownership of ALL FILES to build user
54
# https://bugs.archlinux.org/task/63396
55
chown -R root:root "${pkgdir}"
56
57
# package zsh completions
58
install -vDm644 _bw -t "${pkgdir}/usr/share/zsh/site-functions"
59
60
# cleanup
61
sed -e "s|${srcdir}|/|" -i "$pkgdir"/usr/lib/node_modules/@bitwarden/cli/package.json
62
find "$pkgdir"/usr/lib/node_modules -name 'package.json' -exec sed -e "s|${srcdir}||" -i {} \;
63
modclean --path "$pkgdir"/usr/lib -r -a "*.ts,.bin,.github,.vscode,bin.js" --ignore='license'
64
}
65
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |