curly-turtle

MEDIUM

maintainer Horo 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The PKGBUILD runs 'npm install -g --prefix "$pkgdir"/usr curly-turtle' inside package(), pulling the 'curly-turtle' package and all its transitive npm dependencies directly from the npm registry at build/install time without any pinned version lock file, integrity hashes, or source[] declaration. There is no package-lock.json or shrinkwrap committed, so the exact code executed is not reproducible and could change between installs. The package version is controlled only by whatever npm resolves as 'curly-turtle' at that moment (the pkgver field is not passed to npm install). This is a genuine supply-chain concern: a compromised or updated npm package would be silently installed and executed as part of the Arch package. The source[] array only contains a systemd service unit and an install script — the actual application code is entirely unverified. This matches the classic medium-severity pattern of executed code from an external registry without verification.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:24 npm install -g --prefix "$pkgdir"/usr curly-turtle

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD runs 'npm install -g --prefix "$pkgdir"/usr curly-turtle' inside package(), pulling the 'curly-turtle' package and all its transitive npm dependencies directly from the npm registry at build/install time without any pinned version lock file, integrity hashes, or source[] declaration. There is no package-lock.json or shrinkwrap committed, so the exact code executed is not reproducible and could change between installs. The package version is controlled only by whatever npm resolves as 'curly-turtle' at that moment (the pkgver field is not passed to npm install). This is a genuine supply-chain concern: a compromised or updated npm package would be silently installed and executed as part of the Arch package. The source[] array only contains a systemd service unit and an install script — the actual application code is entirely unverified. This matches the classic medium-severity pattern of executed code from an external registry without verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Horo <horo@yoitsu.moe>
    
      2
    
      3pkgname=curly-turtle
    
      4pkgver=v1.3.0
    
      5pkgrel=1
    
      6pkgdesc="A web proxy for Google Search"
    
      7arch=('any')
    
      8url="https://github.com/FiveYellowMice/curly-turtle"
    
      9license=('GPL3')
    
      10depends=('nodejs')
    
      11makedepends=('git' 'npm')
    
      12optdepends=(
    
      13    'nginx: for reverse proxy'
    
      14)
    
      15source=("curly-turtle@.service"
    
      16        "curly-turtle.install")
    
      17sha512sums=("f3c5dd3ca840a4e44d1976241ce572a0cb565e7ade57899916a8448e35404963a0d2955113551f984012ce7aa890543ca7e60e931d116d6715ed7e7fd2730697"
    
      18            "a413e336b56ec8b7788a5a3c198c98a215b4b3b552a3d58882fe633b029bc9f4586163bbcb34d019894c7a59fb595bcab8b031f64c2b4189e34ed7c528b16ae7")
    
      19options=('!strip')
    
      20install="curly-turtle.install"
    
      21package() {
    
      22    cd $pkgdir
    
      23    mkdir -p usr/lib/node_modules/
    
      24    npm install  -g --prefix "$pkgdir"/usr curly-turtle
    
      25    install -Dm644 "$srcdir"/curly-turtle@.service "$pkgdir"/usr/lib/systemd/system/curly-turtle@.service
    
      26    chmod 755 "$pkgdir"/usr/lib/node_modules/curly-turtle
    
      27}
    
      28	
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2