mongosh-git

maintainer dfimium499 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npm install is for a dev dependency (pretty-repl) during build, part of the project's own build process from its git source, not an external unreviewed executable or remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install is for a dev dependency (pretty-repl) during build, part of the project's own build process from its git source, not an external unreviewed executable or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:26 npm install --save-dev pretty-repl

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Zhang Hua<zhanghua.00 at qq dot com>
    
      2# Contributor: Alejandro Quisbert <alejandropqc at protonmail dot com>
    
      3# Contributor: Ali Molaei <ali dot molaei at protonmail dot com> 
    
      4
    
      5pkgname=mongosh-git
    
      6pkgver=1.5.4.r11.g1db42a4c
    
      7pkgrel=3
    
      8pkgdesc="The MongoDB Shell."
    
      9arch=("x86_64" "aarch64")
    
      10depends=("krb5")
    
      11makedepends=("npm" "python" "git" "procps-ng")
    
      12provides=("mongosh" "mongosh-bin")
    
      13conflicts=("mongosh" "mongosh-bin")
    
      14url="https://github.com/mongodb-js/mongosh"
    
      15license=("Apache" "MPL" "custom:Customer Agreement")
    
      16source=("git+${url}.git")
    
      17sha256sums=('SKIP')
    
      18
    
      19pkgver(){
    
      20    cd "${srcdir}/mongosh"
    
      21    git describe --tags --long | sed 's/v//;s/-/.r/;s/-/./g'
    
      22}
    
      23build(){
    
      24    cd "${srcdir}/mongosh"
    
      25    npm run bootstrap
    
      26    npm install --save-dev pretty-repl
    
      27    ./node_modules/.bin/lerna version ${pkgver%%.r*} \
    
      28        --no-changelog --no-push --exact --no-git-tag-version --yes
    
      29    SEGMENT_API_KEY=makepkg npm run compile-exec 
    
      30    # Anything except empty string in key is OK. But I am not sure the actual meaning of this.
    
      31    case ${CARCH} in
    
      32        x86_64)
    
      33            _arch=x64
    
      34            ;;
    
      35        aarch64)
    
      36            _arch=arm64
    
      37            ;;
    
      38        *)
    
      39            _arch=
    
      40            ;;
    
      41    esac
    
      42    npm run evergreen-release package -- --build-variant=linux-${_arch}
    
      43    install -Dm644 tmp/crypt-store/linux-${_arch}/mongodb-linux-none-${_arch}-stable-enterprise/LICENSE-Enterprise.txt \
    
      44        "LICENSE-Customer Agreement.txt"
    
      45}
    
      46# check(){
    
      47#     cd "${srcdir}/mongosh"
    
      48#     ./node_modules/.bin/lerna run test --scope @mongosh/cli-repl
    
      49# }
    
      50package(){
    
      51    cd "${srcdir}/mongosh"
    
      52    install -Dm755 dist/mongosh "${pkgdir}/usr/bin/mongosh"
    
      53    install -Dm644 tmp/mongosh_crypt_v1.so "${pkgdir}/usr/lib/mongosh_crypt_v1.so"
    
      54    install -Dm644 tmp/manpage/mongosh.1.gz "${pkgdir}/usr/share/man/man1/mongosh.1.gz"
    
      55    install -Dm644 "LICENSE-Customer Agreement.txt" "${pkgdir}/usr/share/licenses/mongosh/LICENSE-Customer Agreement.txt"
    
      56}
    
      57
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2