lando-git

maintainer tiziodcaio · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs 'npx @yao-pkg/pkg' during build, which fetches and executes the @yao-pkg/pkg package from the npm registry at build time. While @yao-pkg/pkg is a well-known fork of the 'pkg' tool (used to bundle Node.js apps into standalone binaries) and is a legitimate project, using npx without a pinned version or integrity check means the build silently pulls whatever version is current on npm at build time. This is a real supply-chain concern: a compromised or malicious publish of @yao-pkg/pkg would execute arbitrary code during the build process with the builder's privileges. The main source (lando/core) is from a legitimate GitHub repo, and @yao-pkg/pkg is a recognized tool, but the lack of version pinning and the fact that npx downloads and executes code not covered by any checksum in the PKGBUILD keeps this at medium risk rather than clean.

Triggered rules

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:36 npx @yao-pkg/pkg --config package.json --target node22 --compress GZip --options dns-result-order=ipv4first bin/lando

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD runs 'npx @yao-pkg/pkg' during build, which fetches and executes the @yao-pkg/pkg package from the npm registry at build time. While @yao-pkg/pkg is a well-known fork of the 'pkg' tool (used to bundle Node.js apps into standalone binaries) and is a legitimate project, using npx without a pinned version or integrity check means the build silently pulls whatever version is current on npm at build time. This is a real supply-chain concern: a compromised or malicious publish of @yao-pkg/pkg would execute arbitrary code during the build process with the builder's privileges. The main source (lando/core) is from a legitimate GitHub repo, and @yao-pkg/pkg is a recognized tool, but the lack of version pinning and the fact that npx downloads and executes code not covered by any checksum in the PKGBUILD keeps this at medium risk rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Mantainer: Daniele Basso <d dot bass05 at pm dot me>
    
      2# Contributor: David Parrish <daveparrish@tutanota.com>
    
      3# Thank you inversechi and eschwartz
    
      4
    
      5pkgname=lando-git
    
      6pkgver=3.23.10.r0.g7484a9de
    
      7
    
      8pkgrel=1
    
      9pkgdesc="A free, open source, cross-platform, local development environment and DevOps tool built on Docker container technology [git version]"
    
      10arch=('x86_64')
    
      11url="https://docs.devwithlando.io"
    
      12license=('GPL')
    
      13depends=('docker' 'docker-compose')
    
      14optdepends=('gcc-libs')
    
      15makedepends=('npm' 'git' 'nodejs')
    
      16source=("${pkgname}-core::git+https://github.com/lando/core.git#branch=edge")
    
      17sha256sums=('SKIP')
    
      18conflicts=("lando")
    
      19provides=("lando")
    
      20
    
      21# strip breaks executable
    
      22options=(!strip)
    
      23
    
      24pkgver() {
    
      25    cd "$pkgname"
    
      26    git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      27}
    
      28
    
      29build() {
    
      30  cd "${srcdir:?}/$pkgname-core" || exit
    
      31
    
      32  npm clean-install --prefer-offline --frozen-lockfile --omit=dev
    
      33  # scripts/fatcore-install.sh
    
      34
    
      35  mkdir -p ./dist/@lando
    
      36  npx @yao-pkg/pkg --config package.json --target node22 --compress GZip --options dns-result-order=ipv4first bin/lando
    
      37}
    
      38
    
      39package() {
    
      40  cd "${srcdir}/$pkgname-core" || exit
    
      41  install -D -m 755 "dist/@lando/core" "${pkgdir}/usr/bin/lando"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2