metapi

maintainer wyf9661 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged npx and npm commands are used to build the project's own frontend and backend from source; they execute only project-local scripts or well-known build tools (vite, node-gyp) during the build phase, with no remote code execution or untrusted external package installation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged npx and npm commands are used to build the project's own frontend and backend from source; they execute only project-local scripts or well-known build tools (vite, node-gyp) during the build phase, with no remote code execution or untrusted external package installation.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:59 npm install-scripts approve better-sqlite3 esbuild 2>&1 || true

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:68 (cd node_modules/better-sqlite3 && npm run build-release 2>&1 || npx --yes node-gyp rebuild --release 2>&1 || true)
PKGBUILD:78 npx vite build --config vite.config.ts 2>&1

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: wyf9661 <wyf9661@hotmail.com>
    
      2pkgname=metapi
    
      3pkgver=1.4.3
    
      4pkgrel=1
    
      5pkgdesc='Meta-layer management and unified proxy for AI API aggregation platforms'
    
      6arch=('any')
    
      7url='https://github.com/wyf9661/metapi'
    
      8license=('MIT')
    
      9options=('!debug')
    
      10depends=(
    
      11  'nodejs>=25'
    
      12)
    
      13makedepends=('npm')
    
      14optdepends=(
    
      15  # Client drivers (mysql2 / pg) ship inside the package via npm node_modules.
    
      16  # These are only the optional local DB *servers* if you self-host them.
    
      17  'mariadb: local MySQL-compatible server (set DB_TYPE=mysql + DB_URL)'
    
      18  'postgresql: local PostgreSQL server (set DB_TYPE=postgres + DB_URL)'
    
      19)
    
      20source=("${pkgname}-v${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      21        "${pkgname}.service"
    
      22        "${pkgname}.conf"
    
      23        "${pkgname}.install"
    
      24        "${pkgname}.sysusers"
    
      25        "${pkgname}.tmpfiles"
    
      26        "${pkgname}-backup.service"
    
      27        "${pkgname}-backup.timer")
    
      28sha256sums=(
    
      29            'ddb69e21c56d7018d7d0527e7fc24e8c0e5ebffcc1f9b971211010abbcbd2ca0'
    
      30            '1f5dede1712658ac3e276d83ac4cad541a636c54f084b07d8c7778b8c69bce95'
    
      31            '885b68e552440009d1fa8802650ad9af283f3eec641e9c22bd6a505832b0a177'
    
      32            '9ea3f6da87f5a204c792c94707423ab657ee1ba0df729a05204f004b3576b75e'
    
      33            '355b30e8ae273a87d14bd7afcac367cee0d44f01d57d41eac6747c67d17afb40'
    
      34            '6f52d5800aa5cd0c8e5eb5a463fb09711c7460bcf9f6c95a477c3303f37f067c'
    
      35            '325e934978093ffd944e0959d7dbda0a2b435ecbc357d5e882cf005ff973e247'
    
      36            '2d93e88ae563499ec9c5d51601584e1839681b71c3c30a495e50c851034c3ccb'
    
      37)
    
      38
    
      39backup=("etc/${pkgname}/env")
    
      40install="${pkgname}.install"
    
      41
    
      42build() {
    
      43  cd "${srcdir}/${pkgname}-${pkgver}"
    
      44
    
      45  # Isolate npm cache to srcdir to avoid polluting the user's ~/.npm/ cache
    
      46  # with build artifacts.
    
      47  export npm_config_cache="${srcdir}/npm-cache"
    
      48  mkdir -p "${npm_config_cache}"
    
      49
    
      50  # Install all dependencies, skip lifecycle scripts (native modules
    
      51  # are compiled explicitly in the next step — much faster than letting
    
      52  # npm ci compile every transitive native dep during install).
    
      53  npm ci --ignore-scripts --include=dev --no-audit --no-fund 2>&1
    
      54
    
      55  # npm >= 12 blocks install-scripts unless approved. Approve only the
    
      56  # modules we actually need, then rebuild them so better_sqlite3.node
    
      57  # is present at runtime.
    
      58  if npm install-scripts --help >/dev/null 2>&1; then
    
      59    npm install-scripts approve better-sqlite3 esbuild 2>&1 || true
    
      60  fi
    
      61  npm rebuild esbuild better-sqlite3 --no-audit --no-fund 2>&1
    
      62
    
      63  # Fail early if the SQLite native binding was not produced.
    
      64  if ! find node_modules/better-sqlite3 -name 'better_sqlite3.node' | grep -q .; then
    
      65    echo "ERROR: better_sqlite3.node missing after rebuild" >&2
    
      66    # Fallback: direct node-gyp rebuild inside the package
    
      67    if [ -d node_modules/better-sqlite3 ]; then
    
      68      (cd node_modules/better-sqlite3 && npm run build-release 2>&1 || npx --yes node-gyp rebuild --release 2>&1 || true)
    
      69    fi
    
      70  fi
    
      71  if ! find node_modules/better-sqlite3 -name 'better_sqlite3.node' | grep -q .; then
    
      72    echo "ERROR: better_sqlite3.node still missing" >&2
    
      73    exit 1
    
      74  fi
    
      75
    
      76  # Build frontend (Vite) and backend (TypeScript)
    
      77  # desktop:icons step skipped — the icon files are already in the source tarball.
    
      78  npx vite build --config vite.config.ts 2>&1
    
      79  npm run build:server 2>&1
    
      80
    
      81  # Strip devDependencies — production only
    
      82  npm prune --omit=dev --no-audit --no-fund 2>&1
    
      83
    
      84  # Clean up build artifacts
    
      85  rm -rf node_modules/.cache
    
      86  find node_modules -type f \( -name '*.map' -o -name '*.d.ts' -o -name '*.test.*' \) -delete 2>/dev/null || true
    
      87  find node_modules -type d -name 'test' -prune -exec rm -rf {} + 2>/dev/null || true
    
      88}
    
      89
    
      90package() {
    
      91  cd "${srcdir}/${pkgname}-${pkgver}"
    
      92
    
      93  _destdir="${pkgdir}/usr/share/${pkgname}"
    
      94
    
      95  install -d "${_destdir}"
    
      96  install -d "${pkgdir}/usr/lib/systemd/system"
    
      97  install -d "${pkgdir}/etc/${pkgname}"
    
      98  install -d "${pkgdir}/var/lib/${pkgname}"
    
      99
    
      100  # Copy built application — dist/server (backend), dist/web (frontend), dist/desktop
    
      101  cp -a dist "${_destdir}/"
    
      102  cp -a node_modules "${_destdir}/"
    
      103  cp package.json "${_destdir}/"
    
      104  cp -a drizzle "${_destdir}/" 2>/dev/null || true
    
      105
    
      106  # Install systemd service and config
    
      107  install -Dm644 "${srcdir}/${pkgname}.service" "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
    
      108  install -Dm644 "${srcdir}/${pkgname}-backup.service" "${pkgdir}/usr/lib/systemd/system/${pkgname}-backup.service"
    
      109  install -Dm644 "${srcdir}/${pkgname}-backup.timer" "${pkgdir}/usr/lib/systemd/system/${pkgname}-backup.timer"
    
      110  install -Dm644 "${srcdir}/${pkgname}.conf" "${pkgdir}/etc/${pkgname}/env"
    
      111
    
      112  # Install sysusers and tmpfiles for automatic user/directory creation
    
      113  install -Dm644 "${srcdir}/${pkgname}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
    
      114  install -Dm644 "${srcdir}/${pkgname}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
    
      115
    
      116  # Create a symlink in /usr/bin for convenience
    
      117  mkdir -p "${pkgdir}/usr/bin"
    
      118  cat > "${pkgdir}/usr/bin/${pkgname}" << SCRIPT
    
      119#!/bin/sh
    
      120exec /usr/bin/node /usr/share/${pkgname}/dist/server/index.js "\$@"
    
      121SCRIPT
    
      122  chmod +x "${pkgdir}/usr/bin/${pkgname}"
    
      123
    
      124  # Fix permissions
    
      125  chmod -R a+rX "${_destdir}"
    
      126  chmod 755 "${_destdir}/node_modules/.bin"/* 2>/dev/null || true
    
      127
    
      128  # Strip build intermediate files that embed $srcdir paths
    
      129  find "${_destdir}" -type f \( -name '*.mk' -o -name 'Makefile' -o -name '*.d' \
    
      130    -o -name 'config.gypi' -o -name '*.o' -o -name '*.obj' -o -name '*.intermediate' \) -delete 2>/dev/null || true
    
      131  # also remove path leak from package.json metadata
    
      132  find "${_destdir}" -name package.json -print0 | xargs -r -0 sed -i '/_where/d' 2>/dev/null || true
    
      133
    
      134  # Ensure data directory is writable by the service user
    
      135  chmod 755 "${pkgdir}/var/lib/${pkgname}"
    
      136}
    
      137
    
      138

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: wyf9661 <wyf9661@hotmail.com>
 pkgname=metapi
-pkgver=1.4.2
+pkgver=1.4.3
 pkgrel=1
 pkgdesc='Meta-layer management and unified proxy for AI API aggregation platforms'
 arch=('any')
@@ -26,7 +26,7 @@
         "${pkgname}-backup.service"
         "${pkgname}-backup.timer")
 sha256sums=(
-            '9f619d31dc7d7c675464c63bc69fc49e23e1f74dfe7f19b762954e75eea19757'
+            'ddb69e21c56d7018d7d0527e7fc24e8c0e5ebffcc1f9b971211010abbcbd2ca0'
             '1f5dede1712658ac3e276d83ac4cad541a636c54f084b07d8c7778b8c69bce95'
             '885b68e552440009d1fa8802650ad9af283f3eec641e9c22bd6a505832b0a177'
             '9ea3f6da87f5a204c792c94707423ab657ee1ba0df729a05204f004b3576b75e'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 09:17:30	MEDIUM	2
2026-07-31 00:14:10	LOW	3
2026-07-30 09:14:07	MEDIUM	2
2026-07-30 00:17:23	LOW	4
2026-07-29 09:11:06	MEDIUM	3
2026-07-29 00:25:53	LOW	4
2026-07-28 00:07:28	LOW	4
2026-07-27 13:35:00	MEDIUM	3
2026-07-27 11:35:00	MEDIUM	3
2026-07-27 09:34:56	MEDIUM	3
2026-07-27 00:24:32	LOW	4
2026-07-26 00:07:32	LOW	4
2026-07-25 09:29:42	MEDIUM	3
2026-07-25 00:13:44	LOW	4
2026-07-24 09:27:42	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	4
2026-07-23 09:22:54	MEDIUM	4