nodejs-cross-seed

LOW

maintainer fryfrog 3 votes scanned 2026-10-22 15:35:25.555348

View on AUR

Why flagged

The package installs a Node.js application from the official npm registry, which is a standard and expected source for npm packages; the use of a variable in the package manager command is normal and does not introduce untrusted or ambiguous dependencies.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs a Node.js application from the official npm registry, which is a standard and expected source for npm packages; the use of a variable in the package manager command is normal and does not introduce untrusted or ambiguous dependencies.

PKGBUILD:25 npm install -g --prefix "$pkgdir/usr" ${_npmname}@${pkgver}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Donald Webster <fryfrog@gmail.com>
    
      2
    
      3pkgname=nodejs-cross-seed
    
      4pkgver=6.13.9
    
      5_npmname=cross-seed
    
      6pkgrel=1
    
      7pkgdesc="Download torrents to cross seed based on your existing torrents."
    
      8arch=(any)
    
      9url='https://github.com/cross-seed/cross-seed'
    
      10license=('Apache 2.0')
    
      11depends=('nodejs' 'npm')
    
      12optdepends=(
    
      13  'qbittorrent'
    
      14  'rtorrent'
    
      15)
    
      16source=(http://registry.npmjs.org/${_npmname}/-/${_npmname}-${pkgver}.tgz)
    
      17noextract=(${_npmname}-${pkgver}.tgz)
    
      18sha512sums=('728e3b9e9c082cb8505d269054a031ea3c669aa4f04adb899e6ec1f196c79d81adb5391fcf0d4f51c0158956d9a92df7947884223186b0322a3f5e54dc0bd4a2')
    
      19
    
      20package() {
    
      21  cd "$srcdir"
    
      22  local _npmdir="$pkgdir/usr/lib/node_modules/"
    
      23  mkdir -p "$_npmdir"
    
      24  cd "$_npmdir"
    
      25  npm install -g --prefix "$pkgdir/usr" ${_npmname}@${pkgver}
    
      26  chown -R root:root "${pkgdir}"
    
      27}
    
      28

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-10-22 15:35
@@ -1,7 +1,7 @@
 # Maintainer: Donald Webster <fryfrog@gmail.com>
 
 pkgname=nodejs-cross-seed
-pkgver=6.13.7
+pkgver=6.13.9
 _npmname=cross-seed
 pkgrel=1
 pkgdesc="Download torrents to cross seed based on your existing torrents."
@@ -15,7 +15,7 @@
 )
 source=(http://registry.npmjs.org/${_npmname}/-/${_npmname}-${pkgver}.tgz)
 noextract=(${_npmname}-${pkgver}.tgz)
-sha512sums=('d20f700c20288be73102b409c343a6de10838eaca1409ffcf023c2872ec8fe230f595a1506fef1cecb383f573fe8968f5c75c6ef1772db71cb0017afae03b08b')
+sha512sums=('728e3b9e9c082cb8505d269054a031ea3c669aa4f04adb899e6ec1f196c79d81adb5391fcf0d4f51c0158956d9a92df7947884223186b0322a3f5e54dc0bd4a2')
 
 package() {
   cd "$srcdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-22 15:35:25	Low	1
2026-06-18 16:11:54	Clean	0