groupme

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

• PKGBUILD:24 npm install electron-packager

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD runs 'npm install electron-packager' at build time without pinning a version or declaring it in the source array with a checksum. This means the exact version of electron-packager (and its entire dependency tree) is resolved and downloaded from the npm registry at build time with no integrity verification beyond whatever npm itself provides. While electron-packager is a well-known, legitimate tool, fetching and executing undeclared, unpinned npm packages during the build phase is a genuine supply-chain concern: a compromised or typosquatted package could execute arbitrary code during 'npm run build-linux'. Additionally, 'npm install' for the project's own dependencies also pulls unchecked packages. The source tarball itself is from the official GitHub repo with an md5sum, which is fine, but the npm-fetched code is unverified. This is a real medium-severity supply-chain risk, not a false positive.