netlify
MEDIUM
maintainer macxcool
8 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package installs additional npm packages (node-gyp, node-addon-api) not declared in dependencies, which could introduce unreviewed code from external sources at build time.
Triggered rules
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:27
npm install -g --prefix "${pkgdir}/usr" node-gyp node-addon-api ${_npmname}@${_npmver}
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs additional npm packages (node-gyp, node-addon-api) not declared in dependencies, which could introduce unreviewed code from external sources at build time.
-
PKGBUILD:28
npm install -g --prefix "${pkgdir}/usr" ${_npmname}@${_npmver}
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: macxcool <macxcool at tutanota dot com>
2
# Contributor: mutantmonkey <aur@mutantmonkey.mx>
3
# Contributor: Boudhayan Gupta <bgupta@kde.org>
4
5
_npmname=netlify-cli
6
_npmver=27.14.2
7
8
pkgname=netlify
9
pkgver=${_npmver}
10
pkgrel=1
11
pkgdesc="Create, deploy, and delete new sites hosted on Netlify straight from your terminal"
12
13
arch=(any)
14
url="https://www.netlify.com/docs/cli/"
15
depends=('nodejs' 'npm')
16
license=('MIT')
17
options=('!strip')
18
source=("https://registry.npmjs.org/${_npmname}/-/${_npmname}-${_npmver}.tgz")
19
noextract=("${_npmname}-${_npmver}.tgz")
20
sha256sums=('fd1cbca242801a5be9c73e06da6de87e05c3d46c7a28dd03772e7a0d9c586396')
21
22
package() {
23
cd ${srcdir}
24
local _npmdir="${pkgdir}/usr/lib/node_modules/"
25
mkdir -p ${_npmdir}
26
cd ${_npmdir}
27
npm install -g --prefix "${pkgdir}/usr" node-gyp node-addon-api ${_npmname}@${_npmver}
28
npm install -g --prefix "${pkgdir}/usr" ${_npmname}@${_npmver}
29
30
# Fix file ownership and permissions
31
chown -R 0:0 "${pkgdir}/usr"
32
find "${pkgdir}/usr" -perm -o+w,g+w -exec chmod o-w,g-w {} +
33
chmod +x "${pkgdir}/usr/lib/node_modules/netlify-cli/dist/lib/completion/script.js"
34
35
rm -rf "${pkgdir}/usr/bin/node-gyp"
36
rm -rf "${pkgdir}/usr/lib/node_modules/node-gyp"
37
rm -rf "${pkgdir}/usr/lib/node_modules/node-addon-api"
38
}
39
Changes since previous scan
--- PKGBUILD @ 2026-10-24 00:14+++ PKGBUILD @ 2026-11-01 00:21@@ -3,7 +3,7 @@ # Contributor: Boudhayan Gupta <bgupta@kde.org> _npmname=netlify-cli-_npmver=27.14.0+_npmver=27.14.2 pkgname=netlify pkgver=${_npmver}@@ -17,7 +17,7 @@ options=('!strip') source=("https://registry.npmjs.org/${_npmname}/-/${_npmname}-${_npmver}.tgz") noextract=("${_npmname}-${_npmver}.tgz")-sha256sums=('79a62df743aeab409b477838974a67cf4b071c6fb1a1696e2695eee5282b6f49')+sha256sums=('fd1cbca242801a5be9c73e06da6de87e05c3d46c7a28dd03772e7a0d9c586396') package() { cd ${srcdir}Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 19:41:06 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 19:33:05 | Medium | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 15:16:11 | Medium | 1 |
| 2026-10-16 00:12:47 | Low | 2 |