meshmonitor

LOW

maintainer BluePeril 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Package builds from the project's own GitHub repository via git tag; npm dependencies are fetched from the standard registry as part of a normal Node.js build process, and the flagged 'npm install-scripts approve' calls are just approving native addon build scripts for well-known packages (re2, bcrypt, serialport, etc.), not installing undeclared external packages. The few-votes/recently-uploaded flag is a quality concern but not a security issue.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Package builds from the project's own GitHub repository via git tag; npm dependencies are fetched from the standard registry as part of a normal Node.js build process, and the flagged 'npm install-scripts approve' calls are just approving native addon build scripts for well-known packages (re2, bcrypt, serialport, etc.), not installing undeclared external packages. The few-votes/recently-uploaded flag is a quality concern but not a security issue.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:45 npm install-scripts approve "${_mod}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: blueperil at blueperil dot de
    
      2
    
      3pkgname=meshmonitor
    
      4pkgver=4.17.0
    
      5pkgrel=1
    
      6pkgdesc='Web dashboard for monitoring Meshtastic, MeshCore and MQTT mesh networks'
    
      7arch=('x86_64' 'armv7h' 'aarch64')
    
      8url='https://github.com/Yeraze/meshmonitor'
    
      9license=('BSD-3-Clause')
    
      10depends=('nodejs>=22.0.0' 're2')
    
      11makedepends=('git' 'npm' 'node-gyp' 'python' 'make' 'gcc')
    
      12backup=("etc/default/${pkgname}")
    
      13options=('!debug' '!strip')
    
      14source=("git+${url}.git#tag=v${pkgver/rc/-rc}"
    
      15        "${pkgname}.service"
    
      16        "${pkgname}.sysusers"
    
      17        "${pkgname}.tmpfiles")
    
      18sha256sums=('22cae6495133f3a2f26041e247c4d7a8ea302f5c9848a8a24cc5089cbbeda09b'
    
      19            '996e15ae1f2cc6bc7fb3103d13e502031d415dbb64f1b26872c35424890a50b2'
    
      20            '7ed7cf20001e8fd44b48b0af4af68ff95c1618ee1a5e4c279ba4faaf40b7ecab'
    
      21            '8189cf6775ae2c3975da7d2f557eb881f4badc581637661627e2924a07fc9395')
    
      22
    
      23prepare() {
    
      24    cd "${pkgname}"
    
      25    git submodule update --init --recursive
    
      26}
    
      27
    
      28build() {
    
      29    cd "${pkgname}"
    
      30
    
      31    export npm_config_cache="${srcdir}/npm-cache"
    
      32    export npm_config_nodedir=/usr
    
      33    export npm_config_audit=false
    
      34    export npm_config_fund=false
    
      35    export npm_config_update_notifier=false
    
      36    export NODE_OPTIONS="--max-old-space-size=6144"
    
      37    export RE2_DOWNLOAD_FORCE_BUILD=1
    
      38
    
      39    npm ci --allow-git=all --legacy-peer-deps
    
      40    npm audit fix || echo "Nothing to fix"
    
      41
    
      42    local _mod
    
      43    for _mod in esbuild @scarf/scarf @serialport/bindings-cpp bcrypt \
    
      44                better-sqlite3 puppeteer re2 zstd-napi; do
    
      45        npm install-scripts approve "${_mod}"
    
      46    done
    
      47    npm install --allow-git=all --legacy-peer-deps --prefer-offline
    
      48
    
      49    (
    
      50        cd node_modules/re2
    
      51        node-gyp -j max rebuild
    
      52    )
    
      53
    
      54    npm run build
    
      55    npm run build:server
    
      56    npm prune --omit=dev
    
      57}
    
      58
    
      59package() {
    
      60    cd "${pkgname}"
    
      61    local _lib="${pkgdir}/usr/lib/${pkgname}"
    
      62
    
      63    install -dm755 "${_lib}/protobufs"
    
      64    cp -a package.json dist node_modules "${_lib}/"
    
      65    cp -a protobufs/meshtastic "${_lib}/protobufs/"
    
      66
    
      67    find "${_lib}/node_modules" -type f \( \
    
      68        -iname '*Makefile*' -o -iname 'appveyor.yml' -o -iname '.babelrc' -o \
    
      69        -iname '*.bak' -o -iname 'bower.json' -o -iname '*.c' -o \
    
      70        -iname '*.cc' -o -iname '*.cpp' -o -iname '*.h' -o -iname '*.o' -o \
    
      71        -iname '*.md' -o -iname '*.markdown' -o -iname '*.rst' -o \
    
      72        -iname '.nycrc' -o -iname '.npmignore' -o -iname '.editorconfig' -o \
    
      73        -iname '*.el' -o -iname '.eslintignore' -o -iname '.eslintrc*' -o \
    
      74        -iname '.fimbullinter.yaml' -o -iname '.gitattributes' -o \
    
      75        -iname '.gitmodules' -o -iname '.jshintrc' -o -iname '.jscs.json' -o \
    
      76        -iname '*.log' -o -iname '*logo.svg' -o -iname '.nvmrc' -o \
    
      77        -iname 'package-lock.json' -o -iname '.travis.yml' -o \
    
      78        -iname '.prettierrc' -o -iname '*.sh' -o -iname '.tags*' -o \
    
      79        -iname '.tm_properties' -o -iname '.wotanrc.yaml' -o \
    
      80        -iname 'tsconfig.json' -o -iname 'yarn.lock' -o -iname '*.map' \
    
      81        \) -delete
    
      82
    
      83    find "${_lib}/node_modules" -type d \( \
    
      84        -name '.github' -o -name '.tscache' -o -name '.cache' -o \
    
      85        -path '*/man' -o -path '*/test' -o -path '*/obj.target' -o \
    
      86        -path '*/git-hooks' -o \
    
      87        -path '*/prebuilds/darwin-*' -o -path '*/prebuilds/win32-*' -o \
    
      88        -path '*/prebuilds/android-*' -o -path '*/prebuilds/ios-*' \
    
      89        \) -prune -exec rm -rf {} +
    
      90
    
      91    find "${_lib}" -name package.json -print0 | xargs -r -0 sed -i '/"_where"/d'
    
      92
    
      93    find "${pkgdir}" -type d -exec chmod 755 {} +
    
      94
    
      95    install -Dm644 .env.example "${pkgdir}/etc/default/${pkgname}"
    
      96    cat >> "${pkgdir}/etc/default/${pkgname}" <<ENV
    
      97
    
      98# Arch Linux paths
    
      99DATA_DIR=/var/lib/meshmonitor
    
      100DATABASE_PATH=/var/lib/meshmonitor/meshmonitor.db
    
      101BACKUP_DIR=/var/lib/meshmonitor/backups
    
      102SYSTEM_BACKUP_DIR=/var/lib/meshmonitor/system-backups
    
      103ENV
    
      104
    
      105    install -Dm644 "${srcdir}/${pkgname}.service"  "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
    
      106    install -Dm644 "${srcdir}/${pkgname}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
    
      107    install -Dm644 "${srcdir}/${pkgname}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
    
      108
    
      109    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      110}
    
      111

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3
2026-10-13 19:20:37	Low	3
2026-10-13 19:18:20	Medium	2