lockee

maintainer heddson · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD uses `npm install -g` without a lockfile (no package-lock.json is included in the sources), and the prepare() function modifies package.json to use floating version ranges ('3.x') for sqlite3 and node-sass dependencies. This means at build time, npm will resolve and download whatever versions satisfy '3.x' from the npm registry, without any integrity verification. The actual npm packages installed are not declared in the PKGBUILD sources and have no checksums. This is a genuine supply-chain concern: the installed node modules (including native addons like sqlite3 and node-sass which compile C/C++ code) come from an undeclared, unverified external source. This is a real medium-severity issue — not a false positive — because executed/compiled code is fetched without pinning or integrity checks.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:30 npm install --cache ../cache --user root -g --prefix "${pkgdir}/usr"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD uses `npm install -g` without a lockfile (no package-lock.json is included in the sources), and the prepare() function modifies package.json to use floating version ranges ('3.x') for sqlite3 and node-sass dependencies. This means at build time, npm will resolve and download whatever versions satisfy '3.x' from the npm registry, without any integrity verification. The actual npm packages installed are not declared in the PKGBUILD sources and have no checksums. This is a genuine supply-chain concern: the installed node modules (including native addons like sqlite3 and node-sass which compile C/C++ code) come from an undeclared, unverified external source. This is a real medium-severity issue — not a false positive — because executed/compiled code is fetched without pinning or integrity checks.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Maxim Andersson <thesilentboatman@gmail.com>
    
      2
    
      3pkgname=lockee
    
      4pkgver=1.0.0
    
      5pkgrel=2
    
      6pkgdesc="Temporary encrypted file lockers on the web"
    
      7arch=('any')
    
      8url="https://github.com/hbons/Lockee"
    
      9license=('AGPL3')
    
      10depends=('nodejs')
    
      11makedepends=('npm')
    
      12options=(!emptydirs)
    
      13source=("https://github.com/hbons/${pkgname^}/archive/${pkgver}.tar.gz")
    
      14sha256sums=('241c555d4422b53ba144c55e4ac749c7a1b86e813537473666e8397d6d30d739')
    
      15
    
      16prepare() {
    
      17  cd "${srcdir}/${pkgname^}-${pkgver}"
    
      18
    
      19  # Bumping the sqlite3 and node-sass dependencies 
    
      20  sed -i 's/2.1.1/3.x/g' package.json
    
      21  sed -i 's/3.0.0-alpha.0/3.x/g' package.json
    
      22
    
      23  # Fix path in service file
    
      24  sed -i 's|share/lockee|lib/node_modules/Lockee|g' "${pkgname}.service"
    
      25}
    
      26
    
      27package() {
    
      28  cd "${srcdir}/${pkgname^}-${pkgver}"
    
      29
    
      30  npm install --cache ../cache --user root -g --prefix "${pkgdir}/usr"
    
      31  install -Dm644 "${pkgname}.service" -t "${pkgdir}/usr/lib/systemd/system"
    
      32}
    
      33
    
      34# vim:set ts=2 sw=2 et:
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2