nodejs-entropic

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

• PKGBUILD:18 npm install -g --user root --prefix "$pkgdir"/usr "$srcdir"/ds-latest.tgz

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 https://www.entropic.dev/ds-latest.tgz

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt tarball (ds-latest.tgz) from entropic.dev and installs it via 'npm install -g'. Several concerns: (1) The URL uses a 'latest' floating artifact with only an md5sum (weak, collision-prone hash) rather than a versioned artifact with a strong checksum like sha256/sha512, meaning the content can change without the PKGBUILD being updated. (2) entropic.dev is not a standard, well-known package registry mirror — it is the project's own experimental registry, and while the maintainer's email matches the domain, there is no way to verify the tarball's provenance independently. (3) npm install during package() can pull additional transitive dependencies from the network at install time, introducing further unverifiable code. (4) The tarball contains pre-compiled/bundled JavaScript that will be executed as a CLI tool. This is a genuine supply-chain concern: a compromised or hijacked entropic.dev host could serve malicious code that gets installed system-wide. The md5-only integrity check provides minimal protection. This is a real medium-severity supply-chain risk, not a false positive.