iotacooler

maintainer joshirio · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Multiple supply-chain concerns exist here: (1) The build clones two external git repositories (Qt-AES and iota-cooler-smidgen) without any integrity verification — no checksums, no pinned commits, just branch/tag names that can be force-pushed. (2) 'npm install pkg' fetches the 'pkg' tool from the npm registry at build time without a lockfile or checksum, meaning a compromised npm package could execute arbitrary code during install. (3) The 'pkg' tool then compiles the iota-cooler-smidgen Node.js application into a self-contained binary that is installed to /usr/bin — so the entire npm dependency tree of that project (also fetched without lockfile verification) ends up bundled into an executed binary. These are real supply-chain risks: unverified git clones of code that gets compiled and installed, plus an unverified npm tool that processes that code. The maintainer appears to be the upstream author (same GitHub handle), which slightly reduces but does not eliminate the risk of the personal-repo pattern. Overall this is a genuine medium-severity supply-chain concern.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:23 npm install pkg

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): Multiple supply-chain concerns exist here: (1) The build clones two external git repositories (Qt-AES and iota-cooler-smidgen) without any integrity verification — no checksums, no pinned commits, just branch/tag names that can be force-pushed. (2) 'npm install pkg' fetches the 'pkg' tool from the npm registry at build time without a lockfile or checksum, meaning a compromised npm package could execute arbitrary code during install. (3) The 'pkg' tool then compiles the iota-cooler-smidgen Node.js application into a self-contained binary that is installed to /usr/bin — so the entire npm dependency tree of that project (also fetched without lockfile verification) ends up bundled into an executed binary. These are real supply-chain risks: unverified git clones of code that gets compiled and installed, plus an unverified npm tool that processes that code. The maintainer appears to be the upstream author (same GitHub handle), which slightly reduces but does not eliminate the risk of the personal-repo pattern. Overall this is a genuine medium-severity supply-chain concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Oirio Joshi <joshirio@protonmail.com>
    
      2pkgname=iotacooler
    
      3pkgver=1.1
    
      4pkgrel=3
    
      5pkgdesc="Cold transaction signer for IOTA"
    
      6arch=('x86_64')
    
      7url="https://github.com/joshirio/iota-cooler"
    
      8license=('MIT')
    
      9depends=('qt5-base' 'qt5-svg' 'qt5-imageformats')
    
      10makedepends=('git' 'nodejs' 'npm')
    
      11source=("https://github.com/joshirio/iota-cooler/releases/download/v$pkgver/$pkgname-$pkgver-src.tar.gz")
    
      12md5sums=('e15d948e8796f0448bcebea2c03aa049')
    
      13options=('!strip') #skip because iotacooler-smidgen doesn't work: 'pkg: failed to read file'
    
      14
    
      15build() {
    
      16  # iotacooler
    
      17  git clone https://github.com/joshirio/Qt-AES.git utils/Qt-AES/
    
      18  qmake-qt5 -config release
    
      19  make
    
      20  
    
      21  # iotacooler-smidgen
    
      22  git clone --branch iotacooler-v$pkgver https://github.com/joshirio/iota-cooler-smidgen.git
    
      23  npm install pkg
    
      24  cd iota-cooler-smidgen/
    
      25  npm install 
    
      26  node ../node_modules/pkg/lib-es5/bin.js  . --target node10-linux -o iotacooler-smidgen #node10 last known working version
    
      27}
    
      28
    
      29package() {
    
      30  cd "$srcdir"
    
      31
    
      32  # Binaries
    
      33  install -Dm755 "$srcdir/iota-cooler" "${pkgdir}/usr/bin/iota-cooler"
    
      34  install -Dm755 "$srcdir/iota-cooler-smidgen/iotacooler-smidgen" "${pkgdir}/usr/bin/iotacooler-smidgen"
    
      35
    
      36  # Icons and desktop files
    
      37  install -d "${pkgdir}/usr/share/"
    
      38  cp -R "$srcdir/stuff/deployment/linux/appimage/usr/share/applications/" "${pkgdir}/usr/share/"
    
      39  cp -R "$srcdir/stuff/deployment/linux/appimage/usr/share/pixmaps/" "${pkgdir}/usr/share/"
    
      40
    
      41  # Copy license
    
      42  install -Dm644 "$srcdir/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2