curly-turtle

maintainer Horo · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs 'npm install -g --prefix "$pkgdir"/usr curly-turtle' inside package(), pulling the 'curly-turtle' package and all its transitive npm dependencies directly from the npm registry at build/install time without any pinned version lock file, integrity hashes, or source[] declaration. There is no package-lock.json or shrinkwrap committed, so the exact code executed is not reproducible and could change between installs. The package version is controlled only by whatever npm resolves as 'curly-turtle' at that moment (the pkgver field is not passed to npm install). This is a genuine supply-chain concern: a compromised or updated npm package would be silently installed and executed as part of the Arch package. The source[] array only contains a systemd service unit and an install script — the actual application code is entirely unverified. This matches the classic medium-severity pattern of executed code from an external registry without verification.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:24 npm install -g --prefix "$pkgdir"/usr curly-turtle

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD runs 'npm install -g --prefix "$pkgdir"/usr curly-turtle' inside package(), pulling the 'curly-turtle' package and all its transitive npm dependencies directly from the npm registry at build/install time without any pinned version lock file, integrity hashes, or source[] declaration. There is no package-lock.json or shrinkwrap committed, so the exact code executed is not reproducible and could change between installs. The package version is controlled only by whatever npm resolves as 'curly-turtle' at that moment (the pkgver field is not passed to npm install). This is a genuine supply-chain concern: a compromised or updated npm package would be silently installed and executed as part of the Arch package. The source[] array only contains a systemd service unit and an install script — the actual application code is entirely unverified. This matches the classic medium-severity pattern of executed code from an external registry without verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Horo <horo@yoitsu.moe>
    
      2
    
      3pkgname=curly-turtle
    
      4pkgver=v1.3.0
    
      5pkgrel=1
    
      6pkgdesc="A web proxy for Google Search"
    
      7arch=('any')
    
      8url="https://github.com/FiveYellowMice/curly-turtle"
    
      9license=('GPL3')
    
      10depends=('nodejs')
    
      11makedepends=('git' 'npm')
    
      12optdepends=(
    
      13    'nginx: for reverse proxy'
    
      14)
    
      15source=("curly-turtle@.service"
    
      16        "curly-turtle.install")
    
      17sha512sums=("f3c5dd3ca840a4e44d1976241ce572a0cb565e7ade57899916a8448e35404963a0d2955113551f984012ce7aa890543ca7e60e931d116d6715ed7e7fd2730697"
    
      18            "a413e336b56ec8b7788a5a3c198c98a215b4b3b552a3d58882fe633b029bc9f4586163bbcb34d019894c7a59fb595bcab8b031f64c2b4189e34ed7c528b16ae7")
    
      19options=('!strip')
    
      20install="curly-turtle.install"
    
      21package() {
    
      22    cd $pkgdir
    
      23    mkdir -p usr/lib/node_modules/
    
      24    npm install  -g --prefix "$pkgdir"/usr curly-turtle
    
      25    install -Dm644 "$srcdir"/curly-turtle@.service "$pkgdir"/usr/lib/systemd/system/curly-turtle@.service
    
      26    chmod 755 "$pkgdir"/usr/lib/node_modules/curly-turtle
    
      27}
    
      28	
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2