mdcz-server

LOW

maintainer evine 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The npm install in build() runs on the project's own source after pnpm install in prepare(); 'approve better-sqlite3 impit sharp' are likely arguments to npm install-scripts, not external packages, and the build is from a verified upstream tarball.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install in build() runs on the project's own source after pnpm install in prepare(); 'approve better-sqlite3 impit sharp' are likely arguments to npm install-scripts, not external packages, and the build is from a verified upstream tarball.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:42 npm install-scripts approve better-sqlite3 impit sharp

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: devome <evinedeng@hotmail.com>
    
      2
    
      3_reponame=mdcz
    
      4pkgname="${_reponame}-server"
    
      5pkgver=0.15.0
    
      6pkgrel=1
    
      7pkgdesc="Media metadata scraper (server)"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/ShotHeadman/${_reponame}"
    
      10license=("GPL-3.0-or-later")
    
      11backup=("etc/conf.d/${_reponame}")
    
      12depends=("nodejs")
    
      13makedepends=("npm" "pnpm")
    
      14source=("${_reponame}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      15        "${_reponame}.service"
    
      16        "${_reponame}.sysusers"
    
      17        "${_reponame}.tmpfiles"
    
      18        "${_reponame}u.service")
    
      19sha256sums=('2acb0efab3fe4acea9f49e695c21e57f8e13d05ae58f27aefaba62c5ab3e365d'
    
      20            'b238101b924496e6257593a82405e984e9373aac52a06cdbf236d30624972c99'
    
      21            'c80caf8e5dc0ec46f3aefd2b207a2ddf035685874102698196f050afe7719310'
    
      22            '5325bb75ca4acdadef92d12d159ea2ade7f80cc4cb57b48e08274a8a625d6d66'
    
      23            '28e159c1da2e09fede6d97f4a9a2b4ed53039dca99ac189efaf6b4496aef7529')
    
      24
    
      25prepare() {
    
      26    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      27    export ELECTRON_OVERRIDE_DIST_PATH="/usr/lib/$_electron"
    
      28
    
      29    rm -rf "${pkgname}" &>/dev/null
    
      30    cd "${_reponame}-${pkgver}"
    
      31    sed -i "s|^MDCZ_WEB_DIST_DIR=web|MDCZ_WEB_DIST_DIR=/usr/lib/mdcz/server/web|" apps/server/.env.example
    
      32    pnpm install --frozen-lockfile
    
      33}
    
      34
    
      35build() {
    
      36    cd "${_reponame}-${pkgver}"
    
      37    pnpm run package:webui
    
      38    rm -rf "release/staging/${_reponame}-${pkgver}/"{systemd,install.*,start.*}
    
      39    cp -ar "release/staging/${_reponame}-${pkgver}" "../${pkgname}"
    
      40    cd "../${pkgname}"
    
      41    npm install --omit=dev --no-audit --no-fund --no-package-lock
    
      42    npm install-scripts approve better-sqlite3 impit sharp
    
      43    npm rebuild
    
      44    find . -type f -name "*.map" -delete
    
      45    grep -rl "${srcdir}/${pkgname}" . | xargs -I {} sed -i "s|${srcdir}/${pkgname}|/usr/lib/${_reponame}/server|g" {}
    
      46    perl -0777 -pe 's{
    
      47        (?:\#.*\n)*
    
      48        \#?\s*(?:MDCZ_HOME|MDCZ_CONFIG_DIR|MDCZ_DATA_DIR|MDCZ_DATABASE_PATH)=.*\n
    
      49        (?:\n)?
    
      50    }{}gx' .env.example > "../${_reponame}.conf"
    
      51}
    
      52
    
      53package() {
    
      54    install -Dm644 "${_reponame}.conf"     "${pkgdir}/etc/conf.d/${_reponame}"
    
      55    install -Dm644 "${_reponame}.service"  "${pkgdir}/usr/lib/systemd/system/${_reponame}.service"
    
      56    install -Dm644 "${_reponame}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${_reponame}.conf"
    
      57    install -Dm644 "${_reponame}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${_reponame}.conf"
    
      58    install -Dm644 "${_reponame}u.service" "${pkgdir}/usr/lib/systemd/user/${_reponame}.service"
    
      59    install -dm755                         "${pkgdir}/usr/lib/${_reponame}"
    
      60    cp -a -r --preserve=mode "${pkgname}"  "${pkgdir}/usr/lib/${_reponame}/server"
    
      61}
    
      62

Changes since previous scan

--- PKGBUILD @ 2026-10-05 23:40
+++ PKGBUILD @ 2026-10-17 00:21
@@ -2,7 +2,7 @@
 
 _reponame=mdcz
 pkgname="${_reponame}-server"
-pkgver=0.18.0
+pkgver=0.15.0
 pkgrel=1
 pkgdesc="Media metadata scraper (server)"
 arch=('x86_64' 'aarch64')
@@ -16,7 +16,7 @@
         "${_reponame}.sysusers"
         "${_reponame}.tmpfiles"
         "${_reponame}u.service")
-sha256sums=('1697faec388fbc04931831afbba7dc2e39ba09aa3c23e62e799a1cd89f6624de'
+sha256sums=('2acb0efab3fe4acea9f49e695c21e57f8e13d05ae58f27aefaba62c5ab3e365d'
             'b238101b924496e6257593a82405e984e9373aac52a06cdbf236d30624972c99'
             'c80caf8e5dc0ec46f3aefd2b207a2ddf035685874102698196f050afe7719310'
             '5325bb75ca4acdadef92d12d159ea2ade7f80cc4cb57b48e08274a8a625d6d66'

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 23:40:58	Medium	1
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2