nodejs-fast-cli
MEDIUM
maintainer ectospasm
3 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The PKGBUILD installs 'puppeteer' via npm at package time using a variable name without pinning or verifying its source, introducing a supply-chain risk from an undeclared external package.
Triggered rules
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:71
npm install -g --prefix "$pkgdir/usr" puppeteer
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The PKGBUILD installs 'puppeteer' via npm at package time using a variable name without pinning or verifying its source, introducing a supply-chain risk from an undeclared external package.
-
PKGBUILD:70
npm install -g --prefix "$pkgdir/usr" $_npmname@$pkgver
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Trey Blancher < trey at blancher dot net >
2
#
3
# Generated from npm2PKGBUILD
4
#
5
# Note, fast-cli uses puppeteer, which contains chromium. The dependencies of
6
# chromium are included, otherwise fast-cli won't work as expected. It's more
7
# than just including the library/shared object (.so/ldd) dependencies of the
8
# chromium binary. This is a limitation of puppeteer. It uses chromium's
9
# Javascript engine to parse and navigate web pages. fast.com is heavily
10
# Javascript dependent, Netflix doesn't have a separate way to test outside of
11
# this web page.
12
#
13
pkgname=nodejs-fast-cli
14
_npmname=${pkgname/nodejs-/}
15
pkgver=5.2.0
16
pkgrel=2
17
pkgdesc="Test your download and upload speed using fast.com from Netflix"
18
arch=(any)
19
url="https://github.com/sindresorhus/fast-cli#readme"
20
license=(MIT)
21
depends=(
22
'alsa-lib'
23
'aom'
24
'brotli'
25
'dav1d'
26
'dbus'
27
'desktop-file-utils'
28
'ffmpeg'
29
'flac'
30
'fontconfig'
31
'freetype2'
32
'gtk3'
33
'harfbuzz'
34
'hicolor-icon-theme'
35
'icu'
36
'jsoncpp'
37
'libcups'
38
'libffi'
39
'libgcrypt'
40
'libjpeg-turbo'
41
'libpng'
42
'libpulse'
43
'libva'
44
'libwebp'
45
'libxml2'
46
'libxslt'
47
'libxss'
48
'minizip'
49
'nodejs'
50
'npm'
51
'nss'
52
'opus'
53
'pciutils'
54
're2'
55
'snappy'
56
'systemd'
57
'ttf-liberation'
58
'woff2'
59
'xdg-utils'
60
)
61
optdepends=()
62
source=(https://registry.npmjs.org/$_npmname/-/$_npmname-$pkgver.tgz)
63
noextract=($_npmname-$pkgver.tgz)
64
65
package() {
66
cd $srcdir
67
local _npmdir="$pkgdir/usr/lib/node_modules/"
68
mkdir -p $_npmdir
69
cd $_npmdir
70
npm install -g --prefix "$pkgdir/usr" $_npmname@$pkgver
71
npm install -g --prefix "$pkgdir/usr" puppeteer
72
chown -R root:root "$pkgdir"
73
}
74
75
# vim:set ts=2 sw=2 et:
76
sha256sums=('05e8cd8259e60631c280efb8e0d8c985aef402c76e8953f234bc4c3028b8fed5')
77
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |