evcc-git

maintainer Simpson474 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD builds evcc from its official GitHub source (evcc-io/evcc). The 'npm install vite' call installs vite locally into the build directory, which is a common pattern when the project's package.json doesn't list vite as a dependency but the Makefile requires it. Vite is a well-known, widely-used build tool from the npm registry, not an obscure or personal package. The npm registry does carry supply-chain risks in general, but vite specifically is a mainstream tool with millions of weekly downloads and active maintenance. This is sloppy packaging (vite should ideally be in makedepends or the project's package.json should declare it), but it's not meaningfully different in risk from any other npm-based build process. The resulting binary comes from the official evcc source repo. This is low risk — sloppy but not a genuine supply-chain concern beyond the ordinary risks of any npm build.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The PKGBUILD builds evcc from its official GitHub source (evcc-io/evcc). The 'npm install vite' call installs vite locally into the build directory, which is a common pattern when the project's package.json doesn't list vite as a dependency but the Makefile requires it. Vite is a well-known, widely-used build tool from the npm registry, not an obscure or personal package. The npm registry does carry supply-chain risks in general, but vite specifically is a mainstream tool with millions of weekly downloads and active maintenance. This is sloppy packaging (vite should ideally be in makedepends or the project's package.json should declare it), but it's not meaningfully different in risk from any other npm-based build process. The resulting binary comes from the official evcc source repo. This is low risk — sloppy but not a genuine supply-chain concern beyond the ordinary risks of any npm build.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:26 npm install vite

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Simpson474
    
      2
    
      3pkgname=evcc-git
    
      4pkgver=r7390.g37fa5345f
    
      5pkgrel=1
    
      6pkgdesc="evcc is an extensible EV Charge Controller and home energy management system"
    
      7arch=(any)
    
      8url="https://evcc.io/"
    
      9license=('MIT')
    
      10conflicts=('evcc-bin')
    
      11provides=("evcc=${pkgver}")
    
      12makedepends=('git' 'go' 'npm')
    
      13source=("git+https://github.com/evcc-io/evcc.git")
    
      14sha256sums=('SKIP')
    
      15
    
      16pkgver() {
    
      17  cd "$srcdir/evcc"
    
      18
    
      19  _rev=$(git rev-list --count --all)
    
      20  _hash=$(git rev-parse --short HEAD)
    
      21  printf "r%s.g%s" "$_rev" "$_hash"
    
      22}
    
      23
    
      24build() {
    
      25  cd "$srcdir/evcc"
    
      26  npm install vite
    
      27  make
    
      28}
    
      29
    
      30package() {
    
      31  cd "$srcdir/evcc"
    
      32  install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      33  install -D -m755 evcc "${pkgdir}/usr/bin/evcc"
    
      34  install -D -m644 packaging/init/evcc.service "${pkgdir}/usr/lib/systemd/system/evcc.service"
    
      35
    
      36  printf "g     evcc    -\nu       evcc    -:evcc  \"User for the evcc daemon\"    /dev/null       -" | install -Dm644 /dev/stdin "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
    
      37  printf "d /var/lib/evcc 0755 evcc evcc" | install -Dm644 /dev/stdin "${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2