lockee-git

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs 'npm install' during the package() phase, which fetches and executes npm dependencies from the npm registry without any pinning, lockfile, or integrity verification. The package.json dependencies are also modified via sed to use floating version ranges ('3.x') rather than pinned versions, making the dependency resolution non-deterministic and potentially pulling in compromised packages. While this is a common pattern in AUR Node.js packages and not clearly malicious, it represents a genuine supply-chain concern: arbitrary npm packages are downloaded and executed at build time without checksums or lockfile verification. The source itself is from the legitimate upstream GitHub repo, but the unpinned npm dependency fetching is a real medium-severity supply-chain risk.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:39 npm install --cache ../cache --user root -g --prefix "${pkgdir}/usr"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD runs 'npm install' during the package() phase, which fetches and executes npm dependencies from the npm registry without any pinning, lockfile, or integrity verification. The package.json dependencies are also modified via sed to use floating version ranges ('3.x') rather than pinned versions, making the dependency resolution non-deterministic and potentially pulling in compromised packages. While this is a common pattern in AUR Node.js packages and not clearly malicious, it represents a genuine supply-chain concern: arbitrary npm packages are downloaded and executed at build time without checksums or lockfile verification. The source itself is from the legitimate upstream GitHub repo, but the unpinned npm dependency fetching is a real medium-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Maxim Andersson <thesilentboatman@gmail.com>
    
      2
    
      3pkgname=lockee-git
    
      4_gitname=Lockee
    
      5pkgver=1.0.0.r3.g1c08804
    
      6pkgrel=1
    
      7pkgdesc="Temporary encrypted file lockers on the web"
    
      8arch=('any')
    
      9url="https://github.com/hbons/Lockee"
    
      10license=('AGPL3')
    
      11depends=('nodejs')
    
      12makedepends=('git' 'npm')
    
      13provides=('lockee')
    
      14conflicts=('lockee')
    
      15options=(!emptydirs)
    
      16source=('git://github.com/hbons/Lockee.git')
    
      17sha256sums=('SKIP')
    
      18
    
      19pkgver() {
    
      20  cd "${srcdir}/${_gitname}"
    
      21
    
      22  git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      23}
    
      24
    
      25prepare() {
    
      26  cd "${srcdir}/${_gitname}"
    
      27
    
      28  # Bumping the sqlite3 and node-sass dependencies 
    
      29  sed -i 's/2.1.1/3.x/g' package.json
    
      30  sed -i 's/3.0.0-alpha.0/3.x/g' package.json
    
      31
    
      32  # Fix path in service file
    
      33  sed -i 's|share/lockee|lib/node_modules/Lockee|g' lockee.service
    
      34}
    
      35
    
      36package() {
    
      37  cd "${srcdir}/${_gitname}"
    
      38
    
      39  npm install --cache ../cache --user root -g --prefix "${pkgdir}/usr"
    
      40  install -Dm644 "${_gitname,}.service" -t "${pkgdir}/usr/lib/systemd/system" 
    
      41}
    
      42
    
      43# vim:set ts=2 sw=2 et:
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2