nodejs-fast-cli

maintainer ectospasm · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs 'puppeteer' via npm at package time using a variable name without pinning or verifying its source, introducing a supply-chain risk from an undeclared external package.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:71 npm install -g --prefix "$pkgdir/usr" puppeteer

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The PKGBUILD installs 'puppeteer' via npm at package time using a variable name without pinning or verifying its source, introducing a supply-chain risk from an undeclared external package.

PKGBUILD:70 npm install -g --prefix "$pkgdir/usr" $_npmname@$pkgver

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer:  Trey Blancher < trey at blancher dot net >
    
      2#
    
      3# Generated from npm2PKGBUILD
    
      4# 
    
      5# Note, fast-cli uses puppeteer, which contains chromium.  The dependencies of
    
      6# chromium are included, otherwise fast-cli won't work as expected.  It's more
    
      7# than just including the library/shared object (.so/ldd) dependencies of the
    
      8# chromium binary.  This is a limitation of puppeteer.  It uses chromium's
    
      9# Javascript engine to parse and navigate web pages.  fast.com is heavily
    
      10# Javascript dependent, Netflix doesn't have a separate way to test outside of
    
      11# this web page.
    
      12#
    
      13pkgname=nodejs-fast-cli
    
      14_npmname=${pkgname/nodejs-/}
    
      15pkgver=5.2.0
    
      16pkgrel=2
    
      17pkgdesc="Test your download and upload speed using fast.com from Netflix"
    
      18arch=(any)
    
      19url="https://github.com/sindresorhus/fast-cli#readme"
    
      20license=(MIT)
    
      21depends=(
    
      22         'alsa-lib'
    
      23         'aom'
    
      24         'brotli'
    
      25         'dav1d'
    
      26         'dbus'
    
      27         'desktop-file-utils'
    
      28         'ffmpeg'
    
      29         'flac'
    
      30         'fontconfig'
    
      31         'freetype2'
    
      32         'gtk3'
    
      33         'harfbuzz'
    
      34         'hicolor-icon-theme'
    
      35         'icu'
    
      36         'jsoncpp'
    
      37         'libcups'
    
      38         'libffi'
    
      39         'libgcrypt'
    
      40         'libjpeg-turbo'
    
      41         'libpng'
    
      42         'libpulse'
    
      43         'libva'
    
      44         'libwebp'
    
      45         'libxml2'
    
      46         'libxslt'
    
      47         'libxss'
    
      48         'minizip'
    
      49         'nodejs'
    
      50         'npm'
    
      51         'nss'
    
      52         'opus'
    
      53         'pciutils'
    
      54         're2'
    
      55         'snappy'
    
      56         'systemd'
    
      57         'ttf-liberation'
    
      58         'woff2'
    
      59         'xdg-utils'
    
      60)
    
      61optdepends=()
    
      62source=(https://registry.npmjs.org/$_npmname/-/$_npmname-$pkgver.tgz)
    
      63noextract=($_npmname-$pkgver.tgz)
    
      64
    
      65package() {
    
      66  cd $srcdir
    
      67  local _npmdir="$pkgdir/usr/lib/node_modules/"
    
      68  mkdir -p $_npmdir
    
      69  cd $_npmdir
    
      70  npm install -g --prefix "$pkgdir/usr" $_npmname@$pkgver
    
      71  npm install -g --prefix "$pkgdir/usr" puppeteer
    
      72  chown -R root:root "$pkgdir"
    
      73}
    
      74
    
      75# vim:set ts=2 sw=2 et:
    
      76sha256sums=('05e8cd8259e60631c280efb8e0d8c985aef402c76e8953f234bc4c3028b8fed5')
    
      77

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -10,11 +10,10 @@
 # Javascript dependent, Netflix doesn't have a separate way to test outside of
 # this web page.
 #
-
 pkgname=nodejs-fast-cli
 _npmname=${pkgname/nodejs-/}
 pkgver=5.2.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Test your download and upload speed using fast.com from Netflix"
 arch=(any)
 url="https://github.com/sindresorhus/fast-cli#readme"
@@ -38,7 +37,6 @@
          'libcups'
          'libffi'
          'libgcrypt'
-         'libjpeg'
          'libjpeg-turbo'
          'libpng'
          'libpulse'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 19:21:42	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2