netlify

LOW

maintainer macxcool 8 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs a known npm package from the official npm registry using a fixed version and verified checksum; the use of variables does not introduce untrusted code as the source is pinned and integrity-checked.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a known npm package from the official npm registry using a fixed version and verified checksum; the use of variables does not introduce untrusted code as the source is pinned and integrity-checked.

PKGBUILD:28 npm install -g --prefix "${pkgdir}/usr" ${_npmname}@${_npmver}

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:27 npm install -g --prefix "${pkgdir}/usr" node-gyp node-addon-api ${_npmname}@${_npmver}

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: macxcool <macxcool at tutanota dot com>
    
      2# Contributor: mutantmonkey <aur@mutantmonkey.mx>
    
      3# Contributor: Boudhayan Gupta <bgupta@kde.org>
    
      4
    
      5_npmname=netlify-cli
    
      6_npmver=27.7.0
    
      7
    
      8pkgname=netlify
    
      9pkgver=${_npmver}
    
      10pkgrel=1
    
      11pkgdesc="Create, deploy, and delete new sites hosted on Netlify straight from your terminal"
    
      12
    
      13arch=(any)
    
      14url="https://www.netlify.com/docs/cli/"
    
      15depends=('nodejs' 'npm')
    
      16license=('MIT')
    
      17options=('!strip')
    
      18source=("https://registry.npmjs.org/${_npmname}/-/${_npmname}-${_npmver}.tgz")
    
      19noextract=("${_npmname}-${_npmver}.tgz")
    
      20sha256sums=('e082e12f5c2e26d29ce78f436a3a9ce40ffb00f621f3633c93d385ba56d7fe44')
    
      21
    
      22package() {
    
      23    cd ${srcdir}
    
      24    local _npmdir="${pkgdir}/usr/lib/node_modules/"
    
      25    mkdir -p ${_npmdir}
    
      26    cd ${_npmdir}
    
      27    npm install -g --prefix "${pkgdir}/usr" node-gyp node-addon-api ${_npmname}@${_npmver}
    
      28    npm install -g --prefix "${pkgdir}/usr" ${_npmname}@${_npmver}
    
      29
    
      30    # Fix file ownership and permissions
    
      31    chown -R 0:0 "${pkgdir}/usr"
    
      32    find "${pkgdir}/usr" -perm -o+w,g+w -exec chmod o-w,g-w {} +
    
      33
    
      34    rm -rf "${pkgdir}/usr/bin/node-gyp"
    
      35    rm -rf "${pkgdir}/usr/lib/node_modules/node-gyp"
    
      36    rm -rf "${pkgdir}/usr/lib/node_modules/node-addon-api"
    
      37}
    
      38

Changes since previous scan

--- PKGBUILD @ 2026-09-15 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -3,7 +3,7 @@
 # Contributor: Boudhayan Gupta <bgupta@kde.org>
 
 _npmname=netlify-cli
-_npmver=27.5.1
+_npmver=27.7.0
 
 pkgname=netlify
 pkgver=${_npmver}
@@ -17,7 +17,7 @@
 options=('!strip')
 source=("https://registry.npmjs.org/${_npmname}/-/${_npmname}-${_npmver}.tgz")
 noextract=("${_npmname}-${_npmver}.tgz")
-sha256sums=('e9f1e8fa8f17b2b788c3e362488e60fb03519d14a5bccade2b19dec8f04d40ac')
+sha256sums=('e082e12f5c2e26d29ce78f436a3a9ce40ffb00f621f3633c93d385ba56d7fe44')
 
 package() {
     cd ${srcdir}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 13:22:46	Medium	1
2026-09-16 00:03:17	Low	2
2026-09-15 19:20:17	Medium	1
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 13:22:32	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 15:19:51	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 13:11:32	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2