library-converter-git

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

• PKGBUILD:29 sudo npm install @yao-pkg/pkg

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): Several real concerns here: (1) 'sudo npm install @yao-pkg/pkg' installs an external npm package (a Node.js binary packager) with root privileges during prepare(), bypassing makepkg's sandboxing and pulling in an undeclared dependency from the npm registry at build time. (2) 'sudo cp main /usr/bin/library-converter' installs files with sudo rather than using the proper install() function with $pkgdir, again bypassing makepkg's package isolation. (3) The build process uses @yao-pkg/pkg to compile main.js into a self-contained binary, which bundles the Node.js runtime and all dependencies into a single opaque executable — the resulting binary's contents are not auditable from the PKGBUILD alone. (4) The source is a git repo from the maintainer's own GitHub, and the compiled binary is what gets installed, not the source directly. The combination of sudo usage inside makepkg, an undeclared external tool fetched at build time, and installation of an opaque compiled binary constitutes a genuine medium-severity supply-chain concern, not a false positive.