engined

LOW

maintainer gissf1 0 votes scanned 2026-10-17 07:18:45.462616

View on AUR

Why flagged

The flagged 'npx/bunx' pattern appears to be a static analyzer false positive - the PKGBUILD uses 'bun run build' to build from the project's own git source (official GitHub repo with a pinned tag and checksum), and bunx only appears as a hardcoded path string in unit file generation, not as a remote package executor; the package is a legitimate own-source build with no unverifiable remote downloads or obfuscated payloads.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The flagged 'npx/bunx' pattern appears to be a static analyzer false positive - the PKGBUILD uses 'bun run build' to build from the project's own git source (official GitHub repo with a pinned tag and checksum), and bunx only appears as a hardcoded path string in unit file generation, not as a remote package executor; the package is a legitimate own-source build with no unverifiable remote downloads or obfuscated payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:37 BUN_PATH=/usr/bin/bun BUNX_PATH=/usr/bin/bunx DOCKER_PATH=/usr/bin/docker

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Damon Blais <damon.blais@gmail.com>
    
      2
    
      3pkgname=engined
    
      4pkgver=0.1.0
    
      5pkgrel=1
    
      6pkgdesc="Local model door: one OpenAI-shaped endpoint that owns every inference container on the box"
    
      7arch=('any')
    
      8url="https://github.com/Rethunk-Tech/engined"
    
      9license=('MIT')
    
      10depends=('bun')
    
      11makedepends=('git')
    
      12optdepends=(
    
      13  'docker: run the inference engines and the Cursor TLS bridge'
    
      14  'bubblewrap: read-only sandbox for the opencode engine'
    
      15)
    
      16install=engined.install
    
      17source=("$pkgname::git+$url.git#tag=v$pkgver")
    
      18sha256sums=('7afbea4408001728f0d2fa24b89ed3ce8cadb95c542163c95bf5f9f252116b84')
    
      19
    
      20build() {
    
      21  cd "$pkgname"
    
      22  # The bundle has no runtime dependencies, so no `bun install` is needed.
    
      23  ENGINED_COMMIT=$(git rev-parse HEAD) bun run build
    
      24}
    
      25
    
      26package() {
    
      27  cd "$pkgname"
    
      28  install -Dm0644 dist/main.js "$pkgdir/usr/lib/engined/main.js"
    
      29  install -Dm0644 deploy/Caddyfile.cursor "$pkgdir/usr/lib/engined/Caddyfile.cursor"
    
      30  cp -r --no-preserve=ownership engines "$pkgdir/usr/lib/engined/engines"
    
      31
    
      32  # install.sh's own renderer, so the packaged units cannot drift from the
    
      33  # templates; only the paths differ. %S is the user's state directory.
    
      34  (
    
      35    source scripts/install.sh
    
      36    resolve_paths
    
      37    BUN_PATH=/usr/bin/bun BUNX_PATH=/usr/bin/bunx DOCKER_PATH=/usr/bin/docker
    
      38    UNIT_INSTALL_DIR=/usr/lib/engined UNIT_STATE_DIR=%S/engined
    
      39    install -d "$pkgdir/usr/lib/systemd/user"
    
      40    for unit in engined.service engined-probe.service engined-probe.timer engined-tls.service; do
    
      41      render_unit_file "$unit.in" "$pkgdir/usr/lib/systemd/user/$unit"
    
      42    done
    
      43  )
    
      44
    
      45  # Not under /usr/share/doc, which NoExtract commonly strips: the install
    
      46  # message tells every user to copy it.
    
      47  install -Dm0644 config.example.toml "$pkgdir/usr/share/engined/config.example.toml"
    
      48  install -Dm0644 HUMANS.md "$pkgdir/usr/share/doc/engined/HUMANS.md"
    
      49  cp -r --no-preserve=ownership docs/. "$pkgdir/usr/share/doc/engined/"
    
      50  install -Dm0644 LICENSE "$pkgdir/usr/share/licenses/engined/LICENSE"
    
      51  install -Dm0644 THIRD_PARTY_NOTICES.md "$pkgdir/usr/share/licenses/engined/THIRD_PARTY_NOTICES.md"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 07:18:45	Low	3
2026-10-17 07:17:15	Medium	2