curly-turtle

MEDIUM

maintainer Horo 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD runs 'npm install -g --prefix "$pkgdir"/usr curly-turtle' inside package(), pulling the 'curly-turtle' package and all its transitive npm dependencies directly from the npm registry at build/install time without any pinned version lock file, integrity hashes, or source[] declaration. There is no package-lock.json or shrinkwrap committed, so the exact code executed is not reproducible and could change between installs. The package version is controlled only by whatever npm resolves as 'curly-turtle' at that moment (the pkgver field is not passed to npm install). This is a genuine supply-chain concern: a compromised or updated npm package would be silently installed and executed as part of the Arch package. The source[] array only contains a systemd service unit and an install script — the actual application code is entirely unverified. This matches the classic medium-severity pattern of executed code from an external registry without verification.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:24 npm install -g --prefix "$pkgdir"/usr curly-turtle

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD runs 'npm install -g --prefix "$pkgdir"/usr curly-turtle' inside package(), pulling the 'curly-turtle' package and all its transitive npm dependencies directly from the npm registry at build/install time without any pinned version lock file, integrity hashes, or source[] declaration. There is no package-lock.json or shrinkwrap committed, so the exact code executed is not reproducible and could change between installs. The package version is controlled only by whatever npm resolves as 'curly-turtle' at that moment (the pkgver field is not passed to npm install). This is a genuine supply-chain concern: a compromised or updated npm package would be silently installed and executed as part of the Arch package. The source[] array only contains a systemd service unit and an install script — the actual application code is entirely unverified. This matches the classic medium-severity pattern of executed code from an external registry without verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Horo <horo@yoitsu.moe>
    
      2
    
      3pkgname=curly-turtle
    
      4pkgver=v1.3.0
    
      5pkgrel=1
    
      6pkgdesc="A web proxy for Google Search"
    
      7arch=('any')
    
      8url="https://github.com/FiveYellowMice/curly-turtle"
    
      9license=('GPL3')
    
      10depends=('nodejs')
    
      11makedepends=('git' 'npm')
    
      12optdepends=(
    
      13    'nginx: for reverse proxy'
    
      14)
    
      15source=("curly-turtle@.service"
    
      16        "curly-turtle.install")
    
      17sha512sums=("f3c5dd3ca840a4e44d1976241ce572a0cb565e7ade57899916a8448e35404963a0d2955113551f984012ce7aa890543ca7e60e931d116d6715ed7e7fd2730697"
    
      18            "a413e336b56ec8b7788a5a3c198c98a215b4b3b552a3d58882fe633b029bc9f4586163bbcb34d019894c7a59fb595bcab8b031f64c2b4189e34ed7c528b16ae7")
    
      19options=('!strip')
    
      20install="curly-turtle.install"
    
      21package() {
    
      22    cd $pkgdir
    
      23    mkdir -p usr/lib/node_modules/
    
      24    npm install  -g --prefix "$pkgdir"/usr curly-turtle
    
      25    install -Dm644 "$srcdir"/curly-turtle@.service "$pkgdir"/usr/lib/systemd/system/curly-turtle@.service
    
      26    chmod 755 "$pkgdir"/usr/lib/node_modules/curly-turtle
    
      27}
    
      28	
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2