gnome-shell-extension-mosaic

The static rules flagged this HIGH, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): This PKGBUILD is a legitimate GNOME Shell extension that uses nvm to install a specific Node.js version and npm to fetch typescript@5.7.3 as a build-time dependency for compiling TypeScript source. The pattern is common for GNOME extensions using TypeScript. The source tarball is fetched from the official GitHub repository with a pinned version tag and a sha256 checksum. The npm cache is sandboxed to srcdir. The only real concern is that typescript@5.7.3 is fetched without a lockfile or checksum verification, which is sloppy packaging but not malicious - typescript is a well-known Microsoft package from the official npm registry. No obfuscation, no exfiltration, no payload execution, no source substitution. The cheaper model's HIGH rating is a false positive; the actual risk is low (non-standard but not dangerous packaging practice).