git2md-git

maintainer xpos587 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs `pip install --root="$pkgdir" nbconvert nbformat pymupdf4llm` during the package() phase, pulling three external Python packages directly from PyPI without any version pinning or integrity verification (no hashes, no checksums). These packages are installed into the package root and will be executed on the end user's system. While nbconvert and nbformat are well-known Jupyter ecosystem packages, pymupdf4llm is a less prominent package with a smaller user base, increasing the risk of typosquatting or supply-chain compromise. More fundamentally, bypassing pacman's dependency tracking by using pip inside package() is a genuine supply-chain concern: updates to those PyPI packages are not reviewed by AUR maintainers, checksums are not verified, and the packages are not tracked by pacman. This is a real medium-severity supply-chain risk — executed code from an uncontrolled source with no integrity verification.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:26 pip install --root="$pkgdir" nbconvert nbformat pymupdf4llm

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD runs `pip install --root="$pkgdir" nbconvert nbformat pymupdf4llm` during the package() phase, pulling three external Python packages directly from PyPI without any version pinning or integrity verification (no hashes, no checksums). These packages are installed into the package root and will be executed on the end user's system. While nbconvert and nbformat are well-known Jupyter ecosystem packages, pymupdf4llm is a less prominent package with a smaller user base, increasing the risk of typosquatting or supply-chain compromise. More fundamentally, bypassing pacman's dependency tracking by using pip inside package() is a genuine supply-chain concern: updates to those PyPI packages are not reviewed by AUR maintainers, checksums are not verified, and the packages are not tracked by pacman. This is a real medium-severity supply-chain risk — executed code from an uncontrolled source with no integrity verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Michael <x30827pos@gmail.com>
    
      2pkgname=git2md-git
    
      3reponame=git2md
    
      4pkgver=1.1.3.r0.g$(git rev-parse --short HEAD)
    
      5pkgrel=1
    
      6pkgdesc="Convert Git repository contents to Markdown format"
    
      7arch=('any')
    
      8url="https://github.com/xpos587/$reponame"
    
      9license=('MIT')
    
      10depends=('python' 'python-pathspec')
    
      11makedepends=('git' 'python-pip' 'python-setuptools')
    
      12provides=("python-$reponame")
    
      13conflicts=("python-$reponame")
    
      14source=("git+https://github.com/xpos587/$reponame.git")
    
      15sha256sums=('SKIP')
    
      16
    
      17build() {
    
      18    cd "$srcdir/$reponame"
    
      19    python setup.py build
    
      20}
    
      21
    
      22package() {
    
      23    cd "$srcdir/$reponame"
    
      24    python setup.py install --root="$pkgdir/" --optimize=1
    
      25
    
      26    pip install --root="$pkgdir" nbconvert nbformat pymupdf4llm
    
      27}
    
      28
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2