cash-cli

maintainer akepinski · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs 'cash-cli' directly from the npm registry at build/install time without declaring it as a source, providing no checksum verification, and bypassing Arch's package management for the actual payload. This means the installed binary and all its npm dependencies are fetched at install time from the npm registry with no integrity guarantees baked into the PKGBUILD. Additionally, it uses `npm install --global` inside `package()` which installs outside the `$pkgdir` staging directory (using `$PKGMK_SOURCE_DIR` which is also wrong/nonstandard), making this both a supply-chain concern and a broken package. The npm package could be updated or compromised between PKGBUILD publication and user installation. This is a genuine medium-severity supply-chain risk: executed code from an external source with no pinned version hash or integrity check.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:14 npm install --global cash-cli

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD installs 'cash-cli' directly from the npm registry at build/install time without declaring it as a source, providing no checksum verification, and bypassing Arch's package management for the actual payload. This means the installed binary and all its npm dependencies are fetched at install time from the npm registry with no integrity guarantees baked into the PKGBUILD. Additionally, it uses `npm install --global` inside `package()` which installs outside the `$pkgdir` staging directory (using `$PKGMK_SOURCE_DIR` which is also wrong/nonstandard), making this both a supply-chain concern and a broken package. The npm package could be updated or compromised between PKGBUILD publication and user installation. This is a genuine medium-severity supply-chain risk: executed code from an external source with no pinned version hash or integrity check.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Antoni Kepinski <a[at]kepinski[dot]me>
    
      2pkgname=cash-cli
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="Convert 170 Currency Rates using your terminal!"
    
      6url="https://github.com/xxczaki/cash-cli/"
    
      7arch=('i686' 'x86_64')
    
      8license=('MIT')
    
      9makedepends=('nodejs')
    
      10
    
      11package() {
    
      12	cd "${PKGMK_SOURCE_DIR}"
    
      13
    
      14	npm install --global cash-cli
    
      15}
    
      16

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2