elasticsearch-head-git

maintainer bhyoo · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Package builds from a legitimate project Git repository, depends only on nodejs, and uses standard npm installation; the low severity is due to few votes and recent upload, not malicious content.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package builds from a legitimate project Git repository, depends only on nodejs, and uses standard npm installation; the low severity is due to few votes and recent upload, not malicious content.

PKGBUILD

      1# Maintainer: Byeonghoon Yoo <bh322yoo@gmail.com>
    
      2
    
      3_pkgname=elasticsearch-head
    
      4
    
      5pkgname=${_pkgname}-git
    
      6pkgver=5.0.0.r32.g2d51fec
    
      7pkgrel=2
    
      8pkgdesc="A web front end for an elastic search cluster"
    
      9arch=('any')
    
      10provides=("elasticsearch-head")
    
      11url="https://github.com/mobz/${_pkgname}"
    
      12license=('Apache')
    
      13depends=('nodejs')
    
      14makedepends=('git' 'npm')
    
      15source=("${_pkgname}::git+${url}")
    
      16sha256sums=('SKIP')
    
      17
    
      18pkgver() {
    
      19	cd "${_pkgname}"
    
      20	git describe --long --tags | sed 's/^v//;s/-/.r/;s/-/./'
    
      21}
    
      22
    
      23package() {
    
      24	cd "${_pkgname}"
    
      25	npm install --cache "${srcdir}/npm-cache" --global --prefix "${pkgdir}/usr"
    
      26
    
      27    # Non-deterministic race in npm gives 777 permissions to random directories.
    
      28    # See https://github.com/npm/cli/issues/1103 for details.
    
      29    find "${pkgdir}/usr" -type d -exec chmod 755 {} +
    
      30
    
      31    # npm gives ownership of ALL FILES to build user
    
      32    # https://bugs.archlinux.org/task/63396
    
      33    chown -R root:root "${pkgdir}"
    
      34}
    
      35
    
      36
    
      37# vim:set ts=2 sw=2 et:
    
      38

Changes since previous scan

--- PKGBUILD @ 2026-08-13 00:17
+++ PKGBUILD @ 2026-08-18 00:03
@@ -4,7 +4,7 @@
 
 pkgname=${_pkgname}-git
 pkgver=5.0.0.r32.g2d51fec
-pkgrel=1
+pkgrel=2
 pkgdesc="A web front end for an elastic search cluster"
 arch=('any')
 provides=("elasticsearch-head")
@@ -22,9 +22,7 @@
 
 package() {
 	cd "${_pkgname}"
-	echo $PWD
-	ls -ahl .
-    npm install --cache "${srcdir}/npm-cache"  -g --user root --prefix "${pkgdir}/usr"
+	npm install --cache "${srcdir}/npm-cache" --global --prefix "${pkgdir}/usr"
 
     # Non-deterministic race in npm gives 777 permissions to random directories.
     # See https://github.com/npm/cli/issues/1103 for details.

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 05:25:33	LOW	2
2026-08-13 00:17:07	LOW	3
2026-08-12 05:26:53	LOW	3
2026-08-12 05:22:53	MEDIUM	2