metapi
LOW
maintainer wyf9661
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The flagged npx and npm install commands are used to build the project's own dependencies from its source code, not to execute arbitrary remote code; the package builds from a verifiable GitHub release tarball and poses no supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged npx and npm install commands are used to build the project's own dependencies from its source code, not to execute arbitrary remote code; the package builds from a verifiable GitHub release tarball and poses no supply-chain risk.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:59
npm install-scripts approve better-sqlite3 esbuild 2>&1 || true
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:68
(cd node_modules/better-sqlite3 && npm run build-release 2>&1 || npx --yes node-gyp rebuild --release 2>&1 || true) -
PKGBUILD:78
npx vite build --config vite.config.ts 2>&1
PKGBUILD
3 offending line(s) highlighted
1
# Maintainer: wyf9661 <wyf9661@hotmail.com>
2
pkgname=metapi
3
pkgver=1.9.5
4
pkgrel=1
5
pkgdesc='Meta-layer management and unified proxy for AI API aggregation platforms'
6
arch=('any')
7
url='https://github.com/wyf9661/metapi'
8
license=('MIT')
9
options=('!debug')
10
depends=(
11
'nodejs>=25'
12
)
13
makedepends=('npm')
14
optdepends=(
15
# Client drivers (mysql2 / pg) ship inside the package via npm node_modules.
16
# These are only the optional local DB *servers* if you self-host them.
17
'mariadb: local MySQL-compatible server (set DB_TYPE=mysql + DB_URL)'
18
'postgresql: local PostgreSQL server (set DB_TYPE=postgres + DB_URL)'
19
)
20
source=("${pkgname}-v${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
21
"${pkgname}.service"
22
"${pkgname}.conf"
23
"${pkgname}.install"
24
"${pkgname}.sysusers"
25
"${pkgname}.tmpfiles"
26
"${pkgname}-backup.service"
27
"${pkgname}-backup.timer")
28
sha256sums=(
29
'58190f6b6de83d0c7c0b1f8af40271094279cfe6f8282d7b85c7c4ce68cfb78c'
30
'1f5dede1712658ac3e276d83ac4cad541a636c54f084b07d8c7778b8c69bce95'
31
'885b68e552440009d1fa8802650ad9af283f3eec641e9c22bd6a505832b0a177'
32
'9ea3f6da87f5a204c792c94707423ab657ee1ba0df729a05204f004b3576b75e'
33
'355b30e8ae273a87d14bd7afcac367cee0d44f01d57d41eac6747c67d17afb40'
34
'6f52d5800aa5cd0c8e5eb5a463fb09711c7460bcf9f6c95a477c3303f37f067c'
35
'325e934978093ffd944e0959d7dbda0a2b435ecbc357d5e882cf005ff973e247'
36
'2d93e88ae563499ec9c5d51601584e1839681b71c3c30a495e50c851034c3ccb'
37
)
38
39
backup=("etc/${pkgname}/env")
40
install="${pkgname}.install"
41
42
build() {
43
cd "${srcdir}/${pkgname}-${pkgver}"
44
45
# Isolate npm cache to srcdir to avoid polluting the user's ~/.npm/ cache
46
# with build artifacts.
47
export npm_config_cache="${srcdir}/npm-cache"
48
mkdir -p "${npm_config_cache}"
49
50
# Install all dependencies, skip lifecycle scripts (native modules
51
# are compiled explicitly in the next step — much faster than letting
52
# npm ci compile every transitive native dep during install).
53
npm ci --ignore-scripts --include=dev --no-audit --no-fund 2>&1
54
55
# npm >= 12 blocks install-scripts unless approved. Approve only the
56
# modules we actually need, then rebuild them so better_sqlite3.node
57
# is present at runtime.
58
if npm install-scripts --help >/dev/null 2>&1; then
59
npm install-scripts approve better-sqlite3 esbuild 2>&1 || true
60
fi
61
npm rebuild esbuild better-sqlite3 --no-audit --no-fund 2>&1
62
63
# Fail early if the SQLite native binding was not produced.
64
if ! find node_modules/better-sqlite3 -name 'better_sqlite3.node' | grep -q .; then
65
echo "ERROR: better_sqlite3.node missing after rebuild" >&2
66
# Fallback: direct node-gyp rebuild inside the package
67
if [ -d node_modules/better-sqlite3 ]; then
68
(cd node_modules/better-sqlite3 && npm run build-release 2>&1 || npx --yes node-gyp rebuild --release 2>&1 || true)
69
fi
70
fi
71
if ! find node_modules/better-sqlite3 -name 'better_sqlite3.node' | grep -q .; then
72
echo "ERROR: better_sqlite3.node still missing" >&2
73
exit 1
74
fi
75
76
# Build frontend (Vite) and backend (TypeScript)
77
# desktop:icons step skipped — the icon files are already in the source tarball.
78
npx vite build --config vite.config.ts 2>&1
79
npm run build:server 2>&1
80
81
# Strip devDependencies — production only
82
npm prune --omit=dev --no-audit --no-fund 2>&1
83
84
# Clean up build artifacts
85
rm -rf node_modules/.cache
86
find node_modules -type f \( -name '*.map' -o -name '*.d.ts' -o -name '*.test.*' \) -delete 2>/dev/null || true
87
find node_modules -type d -name 'test' -prune -exec rm -rf {} + 2>/dev/null || true
88
}
89
90
package() {
91
cd "${srcdir}/${pkgname}-${pkgver}"
92
93
_destdir="${pkgdir}/usr/share/${pkgname}"
94
95
install -d "${_destdir}"
96
install -d "${pkgdir}/usr/lib/systemd/system"
97
install -d "${pkgdir}/etc/${pkgname}"
98
install -d "${pkgdir}/var/lib/${pkgname}"
99
100
# Copy built application — dist/server (backend), dist/web (frontend), dist/desktop
101
cp -a dist "${_destdir}/"
102
cp -a node_modules "${_destdir}/"
103
cp package.json "${_destdir}/"
104
cp -a drizzle "${_destdir}/" 2>/dev/null || true
105
106
# Install systemd service and config
107
install -Dm644 "${srcdir}/${pkgname}.service" "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
108
install -Dm644 "${srcdir}/${pkgname}-backup.service" "${pkgdir}/usr/lib/systemd/system/${pkgname}-backup.service"
109
install -Dm644 "${srcdir}/${pkgname}-backup.timer" "${pkgdir}/usr/lib/systemd/system/${pkgname}-backup.timer"
110
install -Dm644 "${srcdir}/${pkgname}.conf" "${pkgdir}/etc/${pkgname}/env"
111
112
# Install sysusers and tmpfiles for automatic user/directory creation
113
install -Dm644 "${srcdir}/${pkgname}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
114
install -Dm644 "${srcdir}/${pkgname}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
115
116
# Create a symlink in /usr/bin for convenience
117
mkdir -p "${pkgdir}/usr/bin"
118
cat > "${pkgdir}/usr/bin/${pkgname}" << SCRIPT
119
#!/bin/sh
120
exec /usr/bin/node /usr/share/${pkgname}/dist/server/index.js "\$@"
121
SCRIPT
122
chmod +x "${pkgdir}/usr/bin/${pkgname}"
123
124
# Fix permissions
125
chmod -R a+rX "${_destdir}"
126
chmod 755 "${_destdir}/node_modules/.bin"/* 2>/dev/null || true
127
128
# Strip build intermediate files that embed $srcdir paths
129
find "${_destdir}" -type f \( -name '*.mk' -o -name 'Makefile' -o -name '*.d' \
130
-o -name 'config.gypi' -o -name '*.o' -o -name '*.obj' -o -name '*.intermediate' \) -delete 2>/dev/null || true
131
# also remove path leak from package.json metadata
132
find "${_destdir}" -name package.json -print0 | xargs -r -0 sed -i '/_where/d' 2>/dev/null || true
133
134
# Ensure data directory is writable by the service user
135
chmod 755 "${pkgdir}/var/lib/${pkgname}"
136
}
137
138
Changes since previous scan
--- PKGBUILD @ 2026-10-30 00:29+++ PKGBUILD @ 2026-11-01 00:21@@ -1,6 +1,6 @@ # Maintainer: wyf9661 <wyf9661@hotmail.com> pkgname=metapi-pkgver=1.9.3+pkgver=1.9.5 pkgrel=1 pkgdesc='Meta-layer management and unified proxy for AI API aggregation platforms' arch=('any')@@ -26,7 +26,7 @@ "${pkgname}-backup.service" "${pkgname}-backup.timer") sha256sums=(- '04625f3c8be8f9140faa0bb11c10d5686e6ad44b47ae4cfe8e046dfd36d911e7'+ '58190f6b6de83d0c7c0b1f8af40271094279cfe6f8282d7b85c7c4ce68cfb78c' '1f5dede1712658ac3e276d83ac4cad541a636c54f084b07d8c7778b8c69bce95' '885b68e552440009d1fa8802650ad9af283f3eec641e9c22bd6a505832b0a177' '9ea3f6da87f5a204c792c94707423ab657ee1ba0df729a05204f004b3576b75e'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 3 |
| 2026-10-31 00:07:41 | Low | 3 |
| 2026-10-30 13:56:02 | Medium | 2 |
| 2026-10-30 00:29:30 | Low | 3 |
| 2026-10-29 13:52:19 | Medium | 2 |
| 2026-10-29 00:13:55 | Low | 3 |
| 2026-10-28 13:50:29 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 3 |
| 2026-10-27 11:47:37 | Medium | 3 |
| 2026-10-27 00:23:28 | Low | 3 |
| 2026-10-26 13:45:05 | Medium | 2 |
| 2026-10-26 00:12:40 | Low | 3 |
| 2026-10-25 00:20:48 | Low | 3 |
| 2026-10-24 00:14:55 | Low | 3 |
| 2026-10-23 00:02:19 | Low | 3 |
| 2026-10-22 00:13:10 | Low | 3 |
| 2026-10-21 00:12:50 | Low | 3 |
| 2026-10-20 00:10:31 | Low | 3 |
| 2026-10-19 13:25:12 | Medium | 2 |
| 2026-10-19 00:03:55 | Low | 3 |