gpk-git

LOW

maintainer thann 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The npm install is part of building the project from its own source in the git repository, which is normal for AUR packages and not a supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npm install is part of building the project from its own source in the git repository, which is normal for AUR packages and not a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:28 npm install -g --prefix "$pkgdir"/usr --user root --unsafe-perm --production

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jonathan Knapp <jaknapp8+aur@gmail.com>
    
      2# Contributor: Braydon Fuller
    
      3# URL: https://github.com/braydonf/gpk
    
      4# Upstream: https://github.com/braydonf/gpk
    
      5
    
      6_pkgname=gpk
    
      7pkgname=gpk-git
    
      8pkgver=2.0.4
    
      9pkgrel=1
    
      10pkgdesc='A decentralized and secure package manager for nodejs.'
    
      11arch=('i686' 'x86_64')
    
      12url='https://github.com/braydonf/gpk'
    
      13license=('APACHE')
    
      14depends=('nodejs' 'python2' 'git')
    
      15#makedepends=('gcc' 'make')
    
      16provides=('gpk')
    
      17conflicts=('gpk')
    
      18source=("$pkgname::git+https://github.com/braydonf/gpk.git")
    
      19md5sums=('SKIP')
    
      20
    
      21pkgver() {
    
      22  cd $pkgname
    
      23  git describe | sed 's/^v//;s/-/./g'
    
      24}
    
      25
    
      26package() {
    
      27  cd "$pkgname"
    
      28  npm install -g --prefix "$pkgdir"/usr --user root --unsafe-perm --production
    
      29  install -D -m644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      30  chmod -R 755 "$pkgdir"/usr/bin
    
      31  #HACK: npm is being lame and only installing a symlink =/
    
      32  rm "$pkgdir/usr/lib/node_modules/$_pkgname"
    
      33  find * -exec install -D -m644 "{}" "$pkgdir/usr/lib/node_modules/$_pkgname/{}" \;
    
      34  find "$pkgdir/usr/lib/node_modules/$_pkgname" -exec chmod +x "{}" \;
    
      35
    
      36  #HACK: remove references to $srcdir & $pkgdir (if you care)
    
      37  # npm install -g removeNPMAbsolutePaths --prefix "$pkgdir"/usr
    
      38  # "$pkgdir"/usr/bin/removeNPMAbsolutePaths "$pkgdir"/usr
    
      39  # npm uninstall -g removeNPMAbsolutePaths --prefix "$pkgdir"/usr
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2