librechat

MEDIUM

maintainer VVS 4 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package installs a prebuilt web application and runs npm install on external dependencies without declaring them, posing a supply-chain risk if the source host is compromised; the .install script also performs privileged operations like user/group creation and directory ownership changes.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:44 npm install --no-save unrun

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:29 chmod g+s /usr/lib/librechat

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package installs a prebuilt web application and runs npm install on external dependencies without declaring them, posing a supply-chain risk if the source host is compromised; the .install script also performs privileged operations like user/group creation and directory ownership changes.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vitaliy VVS Star <vitaliy <dot> star <at> Gmail-DOT-Com>
    
      2# shellcheck shell=bash disable=SC2034,SC2154
    
      3pkgname=librechat
    
      4pkgver=0.8.8
    
      5pkgrel=2
    
      6pkgdesc="Open-source ChatGPT clone fully customizable and compatible with any AI provider"
    
      7arch=('x86_64')
    
      8url="https://github.com/danny-avila/LibreChat"
    
      9license=('MIT')
    
      10depends=(gcc-libs glibc nodejs libvips)
    
      11optdepends=(
    
      12  'mongodb: default DB used by LibreChat'
    
      13  'nginx: http service to optionally serve the librechat webapp'
    
      14  'meilisearch: improved chat indexing and search'
    
      15)
    
      16makedepends=('npm' 'node-gyp' 'pkgconf')
    
      17
    
      18install=librechat.install
    
      19backup=(etc/librechat/librechat.env etc/librechat/librechat.yaml)
    
      20options=(!strip)
    
      21
    
      22source=(
    
      23  "$pkgname-$pkgver.tar.gz::https://github.com/danny-avila/LibreChat/archive/refs/tags/v$pkgver.tar.gz"
    
      24  librechat.install librechat.env librechat.service librechat.sysusers librechat-server.sh
    
      25)
    
      26sha256sums=('3a2811324c95f7d851ebf6a12a5238fd10a96190a473854d8bcbf05ca96e46b8'
    
      27            '063927ce15c895c49252b1d0e12dbf7aa15c6a335630576db7cee0c4beaf964f'
    
      28            'c1996fb6baa3f6decfdf27cac916ab6a9eb49bd9ff28e5a350dc9396c96ff0e4'
    
      29            '6d8d9cbf687b9978ca33be6ae270fe2a6a65938ee945d3dca5435531ba5cadf8'
    
      30            '98e0aa0ac2e301a82d1d9cb567f361cb86af09a9b7b7bf65a526098fc4789339'
    
      31            '0dc9d536ad4740e19ac8346a7e8372b5e65cd0653755db339edc126d019ea955')
    
      32
    
      33build() {
    
      34  cd "LibreChat-$pkgver"
    
      35  # Scope npm config to this build only via env vars.
    
      36  # Do NOT use `npm config set` here: it persists into the invoking
    
      37  # user's ~/.npmrc and breaks npm after the build dir is deleted.
    
      38  export npm_config_cache="$srcdir/.npm-cache"
    
      39  # ponytail: xlsx is pinned to a CDN tarball in package-lock.json, EALLOWREMOTE blocks it
    
      40  export npm_config_allow_remote=true
    
      41  npm ci
    
      42
    
      43  # tsdown requires unrun module which isn't resolved by npm ci
    
      44  npm install --no-save unrun
    
      45
    
      46  # Build the frontend
    
      47  npm run frontend
    
      48  npm prune --omit=dev
    
      49}
    
      50
    
      51package() {
    
      52  cd "LibreChat-$pkgver"
    
      53  # push compiled tree to usrlib restricted to user+group
    
      54  chmod -R g=u . #copy user->group perms
    
      55
    
      56  # package node service
    
      57  install -dm2775 "$pkgdir/usr/lib/${pkgname}"
    
      58  cp -a . "$pkgdir/usr/lib/${pkgname}"
    
      59
    
      60  # package client webapp
    
      61  install -dm775 "$pkgdir/usr/share/webapps/${pkgname}"
    
      62  cp -a client/dist/* "$pkgdir/usr/share/webapps/${pkgname}"
    
      63
    
      64  # clean left over npm .cache directories
    
      65  find "${pkgdir}" -path "*/node_modules/.cache" -type d -exec rm -rf {} + 2>/dev/null || true
    
      66
    
      67  # launch wrapper with env
    
      68  install -dm755 "$pkgdir/usr/bin"
    
      69  install -Dm755 "$srcdir/librechat-server.sh" "$pkgdir/usr/bin/librechat-server"
    
      70
    
      71  # service and service user creation
    
      72  install -Dm644 "$srcdir/$pkgname.service" "$pkgdir/usr/lib/systemd/system/$pkgname.service"
    
      73  install -Dm644 "$srcdir/$pkgname.sysusers" "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      74
    
      75  # Config and sample
    
      76  install -Dm644 "$srcdir/LibreChat-$pkgver/librechat.example.yaml" "$pkgdir/etc/librechat/librechat.yaml"
    
      77  install -Dm644 "$srcdir/librechat.env" "$pkgdir/etc/librechat/librechat.env"
    
      78
    
      79  # Add some docs
    
      80  install -Dm644 "$srcdir/LibreChat-$pkgver"/{client/nginx.conf,rag.yml,README.md,CHANGELOG.md} -t "$pkgdir/usr/share/doc/$pkgname/" || true
    
      81
    
      82  # Populate sample env on top of our defaults
    
      83  cat .env.example >>"$pkgdir/etc/librechat/librechat.env"
    
      84
    
      85  # Add latest examples from source package
    
      86  install -Dm644 "$srcdir/LibreChat-$pkgver/.env.example" "$pkgdir/etc/librechat/librechat.example.env"
    
      87  install -Dm644 "$srcdir/LibreChat-$pkgver/librechat.example.yaml" -t "$pkgdir/etc/librechat"
    
      88
    
      89  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      90}
    
      91
    
      92# vim:set ts=2 sw=2 et:
    
      93

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	3
2026-10-31 00:07:41	Medium	3
2026-10-30 00:29:30	Medium	3
2026-10-29 00:13:55	Medium	3
2026-10-28 00:06:54	Medium	3
2026-10-27 00:23:28	Medium	3
2026-10-26 00:12:40	Medium	3
2026-10-25 00:20:48	Medium	3
2026-10-24 00:14:55	Medium	3
2026-10-23 13:37:25	Medium	3
2026-10-23 00:02:19	Low	3
2026-10-22 00:13:10	Low	3
2026-10-21 00:12:50	Low	3
2026-10-20 00:10:31	Low	3
2026-10-19 00:03:55	Low	3
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3