chromium-pdfjs-git

The static rules flagged this HIGH, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): This PKGBUILD builds the official Mozilla pdf.js project from its official GitHub repository. The source is a well-known, legitimate upstream (github.com/mozilla/pdf.js). The build process uses nvm to install a pinned Node.js version (21.7.3) and then installs gulp globally via npm as a build tool — gulp is a well-known JavaScript task runner explicitly referenced in the project's own build system. The 'npm install -g gulp' is sloppy packaging (gulp should be in makedepends or handled differently) but is not malicious. There is no obfuscation, no encoded payload, no exfiltration, and no attacker-controlled source substitution. The main concerns are: (1) sloppy makedepends declaration with gulp commented out, (2) using nvm inside build() which is non-standard for Arch packaging, and (3) npm install pulling dependencies from the internet during build rather than using a pre-fetched source. These are packaging quality issues, not security threats. The HIGH rating from the cheaper model was a false positive.