groupme-git

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

• PKGBUILD:24 npm install electron-packager

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD has several real supply-chain concerns beyond just 'npm install': (1) It clones the upstream git repo at build time inside package() rather than using the sources array with a proper VCS source, meaning no integrity verification whatsoever on the cloned code. (2) It runs 'npm install' which pulls arbitrary npm packages from the registry at build time with no lockfile pinning or checksum verification. (3) It additionally runs 'npm install electron-packager' pulling another package with no version pin. (4) The cloned code is then compiled and executed via 'npm run build-linux'. (5) pkgver='latest' is a static string, not a real version, meaning updates are never tracked. The combination of unverified git clone + unpinned npm dependency resolution + execution of the resulting build constitutes a genuine supply-chain risk: any compromise of the npm packages or the upstream repo would result in execution of attacker-controlled code during the build. This is a real medium-severity concern, not a false positive.