firefox-extension-single-file

maintainer Kimiblock · 0 votes · base firefox-browser-single-file · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command is used to run rollup for building the extension from the project's own source code, which is fetched from the official GitHub repository; this is a standard build step, not execution of a remote untrusted package.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command is used to run rollup for building the extension from the project's own source code, which is fetched from the official GitHub repository; this is a standard build step, not execution of a remote untrusted package.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:24 npx rollup -c rollup.config.js

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kimiblock Moe
    
      2
    
      3pkgname=(zen-browser-single-file firefox-extension-single-file)
    
      4pkgbase=firefox-browser-single-file
    
      5pkgver=1.2.0
    
      6pkgrel=1
    
      7arch=('any')
    
      8url='https://github.com/gildas-lormeau/SingleFile'
    
      9license=('AGPL-3.0-only')
    
      10groups=('zen-browser-addons' 'firefox-addons')
    
      11pkgdesc='Web Extension for saving a faithful copy of a complete web page in a single HTML file'
    
      12makedepends=('nodejs' 'npm' 'unzip' 'zip' 'git' 'jq')
    
      13source=("source::git+https://github.com/gildas-lormeau/SingleFile.git#tag=v${pkgver}")
    
      14b2sums=('af550ccae3ad03e4b19364780b11e3553577e42fd96d7837f48d09dca1070949acc86c1f26d4ead34ac44aa35d98e4fe09364cf553d118cf79106de4b8c88f0b')
    
      15
    
      16prepare() {
    
      17  cd "${srcdir}/source"
    
      18  npm install
    
      19  npm update
    
      20}
    
      21
    
      22build() {
    
      23    cd "${srcdir}/source"
    
      24    npx rollup -c rollup.config.js
    
      25    cp package.json package.copy.json
    
      26    jq 'del(.dependencies."single-file-cli")' package.copy.json > package.json
    
      27    zip -r singlefile-extension-source.zip manifest.json package.json _locales src rollup*.js .eslintrc.js build-extension.sh
    
      28    mv package.copy.json package.json
    
      29    rm -f singlefile-extension-firefox.zip
    
      30    cp src/core/bg/config.js config.copy.js
    
      31    cp src/core/bg/companion.js companion.copy.js
    
      32    #sed -i "" 's/forceWebAuthFlow: false/forceWebAuthFlow: true/g' src/core/bg/config.js
    
      33    #sed -i "" 's/enabled: true/enabled: false/g' src/core/bg/companion.js
    
      34    zip -r singlefile-extension-firefox.zip manifest.json lib _locales src
    
      35    mv config.copy.js src/core/bg/config.js
    
      36    mv companion.copy.js src/core/bg/companion.js
    
      37}
    
      38
    
      39package_firefox-extension-single-file() {
    
      40    cd "${srcdir}/source"
    
      41    install -Dm644 "${srcdir}/source/singlefile-extension-firefox.zip" "${pkgdir}/usr/lib/firefox/browser/extensions/{531906d3-e22f-4a6c-a102-8057b88a1a63}.xpi"
    
      42}
    
      43
    
      44package_zen-browser-single-file() {
    
      45    cd "${srcdir}/source"
    
      46    install -Dm644 "${srcdir}/source/singlefile-extension-firefox.zip" "${pkgdir}/usr/lib/zen-browser/browser/extensions/{531906d3-e22f-4a6c-a102-8057b88a1a63}.xpi"
    
      47}
    
      48
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2