metube-git

MEDIUM

maintainer caoticofanegas 1 votes scanned 2026-09-07 19:15:19.836787

View on AUR

Why flagged

The PKGBUILD runs 'npm install' with specific external packages (@fortawesome/angular-fontawesome, ngx-socket-io) not declared in source array or verified by checksum, posing a supply-chain risk if the npm registry is compromised or spoofed during build.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:37 npm install @fortawesome/angular-fontawesome@latest ngx-socket-io@latest

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD runs 'npm install' with specific external packages (@fortawesome/angular-fontawesome, ngx-socket-io) not declared in source array or verified by checksum, posing a supply-chain risk if the npm registry is compromised or spoofed during build.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: devome <evinedeng@hotmail.com>
    
      2# Maintainer: caoticofanegas<>
    
      3_pkgname=metube
    
      4pkgname="${_pkgname}-git"
    
      5pkgver=r838.7938837
    
      6pkgrel=1
    
      7pkgdesc="Self-hosted YouTube downloader (web UI for youtube-dl / yt-dlp)"
    
      8arch=("any")
    
      9url="https://github.com/alexta69/${_pkgname}"
    
      10license=("AGPL-3.0-or-later")
    
      11provides=("${_pkgname}")
    
      12conflicts=("${_pkgname}")
    
      13depends=(aria2 ffmpeg python-aiohttp python-brotli python-mutagen python-pycryptodomex python-simple-websocket python-socketio python-watchfiles yt-dlp)
    
      14makedepends=("git" "npm")
    
      15source=("${_pkgname}::git+${url}"
    
      16        "${_pkgname}.service"
    
      17        "${_pkgname}.sh")
    
      18sha256sums=('SKIP'
    
      19            'de07b835827462a4b7c19fe2dd73b02faed87b4a2b33c50627385d4b92bab71c'
    
      20            '2b63a9c2b307da510b6b1804a87f510d2147a45c86e133581297f4ac9c348ac1')
    
      21options=("!strip" "!debug")
    
      22
    
      23prepare() {
    
      24    echo -e "## Means of environment variables see: https://github.com/alexta69/metube\n" > "${_pkgname}.env"
    
      25    find "${_pkgname}/app" -type f | xargs -I {} sed -i 's/\r$//g' {}
    
      26    sed -i 's/python3/python/' "${_pkgname}/app/main.py"
    
      27    awk '/_DEFAULTS *= *\{/,/\s\}/' "${_pkgname}/app/main.py" | sed -n 's/^[ \t]*\([^:]*\):[ \t]*\(.*\),/\1: \2/p' | sed -E -e "s|^'|#|g" -e "s|' ?: |=|" >> "${_pkgname}.env"
    
      28}
    
      29
    
      30pkgver() {
    
      31    cd "${_pkgname}"
    
      32    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      33}
    
      34
    
      35build() {
    
      36    cd "${_pkgname}/ui"
    
      37    npm install @fortawesome/angular-fontawesome@latest ngx-socket-io@latest
    
      38    npm install
    
      39    npm ci
    
      40    ./node_modules/.bin/ng build --configuration production
    
      41}
    
      42
    
      43package() {
    
      44    install -Dm755 "${_pkgname}.sh"       "${pkgdir}/usr/bin/${_pkgname}"
    
      45    install -Dm644 "${_pkgname}.service"  "${pkgdir}/usr/lib/systemd/user/${_pkgname}.service"
    
      46    install -Dm644 "${_pkgname}.env"      "${pkgdir}/usr/share/${_pkgname}/${_pkgname}.env.example"
    
      47
    
      48    cd "${_pkgname}"
    
      49    install -Dm644 app/*.py            -t "${pkgdir}/usr/share/${_pkgname}/app"
    
      50    find "ui/dist" -type f | \
    
      51        xargs -I {} install -Dm644 {}     "${pkgdir}/usr/share/${_pkgname}/"{}
    
      52}
    
      53

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-09-07 19:15
@@ -2,7 +2,7 @@
 # Maintainer: caoticofanegas<>
 _pkgname=metube
 pkgname="${_pkgname}-git"
-pkgver=r725.e30a24f
+pkgver=r838.7938837
 pkgrel=1
 pkgdesc="Self-hosted YouTube downloader (web UI for youtube-dl / yt-dlp)"
 arch=("any")
@@ -34,6 +34,7 @@
 
 build() {
     cd "${_pkgname}/ui"
+    npm install @fortawesome/angular-fontawesome@latest ngx-socket-io@latest
     npm install
     npm ci
     ./node_modules/.bin/ng build --configuration production

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-07 19:15:19	Medium	2
2026-06-18 16:11:54	Clean	0