nodejs-jsfmt

maintainer adelaidacervera · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npm install is for the declared package from the official npm registry, part of normal packaging workflow, not an undeclared external dependency.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install is for the declared package from the official npm registry, part of normal packaging workflow, not an undeclared external dependency.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:21 npm install --user root -g --prefix "$pkgdir/usr" $_npmname@$pkgver

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Carlo Cabanilla <carlo.cabanilla@gmail.com>
    
      2
    
      3_npmname=jsfmt
    
      4pkgname=nodejs-$_npmname
    
      5pkgver=0.5.3
    
      6pkgrel=1
    
      7pkgdesc="gofmt for javascript"
    
      8arch=(any)
    
      9url=http://rdio.github.io/jsfmt/
    
      10license=(Apache)
    
      11depends=('nodejs' 'npm')
    
      12source=(https://registry.npmjs.org/$_npmname/-/$_npmname-$pkgver.tgz)
    
      13noextract=($_npmname-$pkgver.tgz)
    
      14sha256sums=('ce2cc70648bd96c1552d3ba7fd10cba16bbf4d3004fb42ecf17a3eba75a1b33c')
    
      15
    
      16package() {
    
      17  cd "$srcdir"
    
      18  local _npmdir="$pkgdir/usr/lib/node_modules/"
    
      19  mkdir -p "$_npmdir"
    
      20  cd "$_npmdir"
    
      21  npm install --user root -g --prefix "$pkgdir/usr" $_npmname@$pkgver
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2