librechat
maintainer VVS
· 4 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package builds from a legitimate project source and the flagged npm install is part of the normal build process; the privileged install in .install is standard for systemd services and creating system users, not malicious.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project source and the flagged npm install is part of the normal build process; the privileged install in .install is standard for systemd services and creating system users, not malicious.
2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:40
npm install --no-save unrun
MEDIUM
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
.install:29
chmod g+s /usr/lib/librechat
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Vitaliy VVS Star <vitaliy <dot> star <at> Gmail-DOT-Com>
2
# shellcheck shell=bash disable=SC2034,SC2154
3
pkgname=librechat
4
pkgver=0.8.7
5
pkgrel=1
6
pkgdesc="Open-source ChatGPT clone fully customizable and compatible with any AI provider"
7
arch=('x86_64')
8
url="https://github.com/danny-avila/LibreChat"
9
license=('MIT')
10
depends=(gcc-libs glibc nodejs libvips)
11
optdepends=(
12
'mongodb: default DB used by LibreChat'
13
'nginx: http service to optionally serve the librechat webapp'
14
'meilisearch: improved chat indexing and search'
15
)
16
makedepends=('npm' 'node-gyp' 'pkgconf')
17
18
install=librechat.install
19
backup=(etc/librechat/librechat.env etc/librechat/librechat.yaml)
20
options=(!strip)
21
22
source=(
23
"$pkgname-$pkgver.tar.gz::https://github.com/danny-avila/LibreChat/archive/refs/tags/v$pkgver.tar.gz"
24
librechat.install librechat.env librechat.service librechat.sysusers librechat-server.sh
25
)
26
sha256sums=('de94ba3ecc8053f0cf494071da19882e2fe509bfd9f32451f1f12cb715b8e7b6'
27
'063927ce15c895c49252b1d0e12dbf7aa15c6a335630576db7cee0c4beaf964f'
28
'c1996fb6baa3f6decfdf27cac916ab6a9eb49bd9ff28e5a350dc9396c96ff0e4'
29
'6d8d9cbf687b9978ca33be6ae270fe2a6a65938ee945d3dca5435531ba5cadf8'
30
'98e0aa0ac2e301a82d1d9cb567f361cb86af09a9b7b7bf65a526098fc4789339'
31
'0dc9d536ad4740e19ac8346a7e8372b5e65cd0653755db339edc126d019ea955')
32
33
build() {
34
cd "LibreChat-$pkgver"
35
# Install dependencies
36
npm config set cache "$srcdir/.npm-cache"
37
npm ci
38
39
# tsdown requires unrun module which isn't resolved by npm ci
40
npm install --no-save unrun
41
42
# Build the frontend
43
npm run frontend
44
npm prune --omit=dev
45
}
46
47
package() {
48
cd "LibreChat-$pkgver"
49
# push compiled tree to usrlib restricted to user+group
50
chmod -R g=u . #copy user->group perms
51
52
# package node service
53
install -dm2775 "$pkgdir/usr/lib/${pkgname}"
54
cp -a . "$pkgdir/usr/lib/${pkgname}"
55
56
# package client webapp
57
install -dm775 "$pkgdir/usr/share/webapps/${pkgname}"
58
cp -a client/dist/* "$pkgdir/usr/share/webapps/${pkgname}"
59
60
# clean left over npm .cache directories
61
find "${pkgdir}" -path "*/node_modules/.cache" -type d -exec rm -rf {} + 2>/dev/null || true
62
63
# launch wrapper with env
64
install -dm755 "$pkgdir/usr/bin"
65
install -Dm755 "$srcdir/librechat-server.sh" "$pkgdir/usr/bin/librechat-server"
66
67
# service and service user creation
68
install -Dm644 "$srcdir/$pkgname.service" "$pkgdir/usr/lib/systemd/system/$pkgname.service"
69
install -Dm644 "$srcdir/$pkgname.sysusers" "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
70
71
# Config and sample
72
install -Dm644 "$srcdir/LibreChat-$pkgver/librechat.example.yaml" "$pkgdir/etc/librechat/librechat.yaml"
73
install -Dm644 "$srcdir/librechat.env" "$pkgdir/etc/librechat/librechat.env"
74
75
# Add some docs
76
install -Dm644 "$srcdir/LibreChat-$pkgver"/{client/nginx.conf,rag.yml,README.md,CHANGELOG.md} -t "$pkgdir/usr/share/doc/$pkgname/" || true
77
78
# Populate sample env on top of our defaults
79
cat .env.example >>"$pkgdir/etc/librechat/librechat.env"
80
81
# Add latest examples from source package
82
install -Dm644 "$srcdir/LibreChat-$pkgver/.env.example" "$pkgdir/etc/librechat/librechat.example.env"
83
install -Dm644 "$srcdir/LibreChat-$pkgver/librechat.example.yaml" -t "$pkgdir/etc/librechat"
84
85
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
86
}
87
88
# vim:set ts=2 sw=2 et:
89
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 09:20:02 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |
| 2026-07-16 00:05:41 | LOW | 3 |