firefox-extension-single-file

LOW

maintainer Kimiblock 0 votes base firefox-browser-single-file scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The npx command is used to run rollup for building the extension from the project's own source code, which is cloned from the official GitHub repository; this is a standard build practice and does not involve executing untrusted remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command is used to run rollup for building the extension from the project's own source code, which is cloned from the official GitHub repository; this is a standard build practice and does not involve executing untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:24 npx rollup -c rollup.config.js

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kimiblock Moe
    
      2
    
      3pkgname=(zen-browser-single-file firefox-extension-single-file)
    
      4pkgbase=firefox-browser-single-file
    
      5pkgver=1.32.0
    
      6pkgrel=1
    
      7arch=('any')
    
      8url='https://github.com/gildas-lormeau/SingleFile'
    
      9license=('AGPL-3.0-only')
    
      10groups=('zen-browser-addons')
    
      11pkgdesc='Web Extension for saving a faithful copy of a complete web page in a single HTML file'
    
      12makedepends=('nodejs' 'npm' 'unzip' 'zip' 'git' 'jq')
    
      13source=("source::git+https://github.com/gildas-lormeau/SingleFile.git#tag=v${pkgver}")
    
      14b2sums=('c1c62aaaefd5964ac3596c4c3508aa39872261d991310653802f864cd950b9f211d1ca48d1549ce57c20dd4d6c8c1d12659ca1a39ffdd36b7e30869177eea9f4')
    
      15
    
      16prepare() {
    
      17  cd "${srcdir}/source"
    
      18  npm install
    
      19  npm update
    
      20}
    
      21
    
      22build() {
    
      23    cd "${srcdir}/source"
    
      24    npx rollup -c rollup.config.js
    
      25    cp package.json package.copy.json
    
      26    jq 'del(.dependencies."single-file-cli")' package.copy.json > package.json
    
      27    zip -r singlefile-extension-source.zip manifest.json package.json _locales src rollup*.js .eslintrc.js build-extension.sh
    
      28    mv package.copy.json package.json
    
      29    rm -f singlefile-extension-firefox.zip
    
      30    cp src/core/bg/config.js config.copy.js
    
      31    cp src/core/bg/companion.js companion.copy.js
    
      32    #sed -i "" 's/forceWebAuthFlow: false/forceWebAuthFlow: true/g' src/core/bg/config.js
    
      33    #sed -i "" 's/enabled: true/enabled: false/g' src/core/bg/companion.js
    
      34    zip -r singlefile-extension-firefox.zip manifest.json lib _locales src
    
      35    mv config.copy.js src/core/bg/config.js
    
      36    mv companion.copy.js src/core/bg/companion.js
    
      37}
    
      38
    
      39package_firefox-extension-single-file() {
    
      40    cd "${srcdir}/source"
    
      41    install -Dm644 "${srcdir}/source/singlefile-extension-firefox.zip" "${pkgdir}/usr/lib/firefox/browser/extensions/{531906d3-e22f-4a6c-a102-8057b88a1a63}.xpi"
    
      42}
    
      43
    
      44package_zen-browser-single-file() {
    
      45    cd "${srcdir}/source"
    
      46    install -Dm644 "${srcdir}/source/singlefile-extension-firefox.zip" "${pkgdir}/usr/lib/zen-browser/browser/extensions/{531906d3-e22f-4a6c-a102-8057b88a1a63}.xpi"
    
      47}
    
      48
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-10-27 00:23
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,7 +2,7 @@
 
 pkgname=(zen-browser-single-file firefox-extension-single-file)
 pkgbase=firefox-browser-single-file
-pkgver=1.31.3
+pkgver=1.32.0
 pkgrel=1
 arch=('any')
 url='https://github.com/gildas-lormeau/SingleFile'
@@ -11,7 +11,7 @@
 pkgdesc='Web Extension for saving a faithful copy of a complete web page in a single HTML file'
 makedepends=('nodejs' 'npm' 'unzip' 'zip' 'git' 'jq')
 source=("source::git+https://github.com/gildas-lormeau/SingleFile.git#tag=v${pkgver}")
-b2sums=('7f043665894b70a1b3886b50805f869103db94543f9145a7a227923dc5b5a843dc68a938e9a157d224d69a07a1e435335234fbc4b13202ca38158a5a2dfbfb10')
+b2sums=('c1c62aaaefd5964ac3596c4c3508aa39872261d991310653802f864cd950b9f211d1ca48d1549ce57c20dd4d6c8c1d12659ca1a39ffdd36b7e30869177eea9f4')
 
 prepare() {
   cd "${srcdir}/source"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 21:50:44	Medium	1
2026-10-28 00:06:54	Low	2
2026-10-27 21:48:49	Medium	1
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 05:27:35	Medium	1
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 13:22:09	Medium	1
2026-10-18 05:21:06	Medium	1
2026-10-18 00:06:55	Low	2