nodejs-nestjs-cli

LOW

maintainer fupduck 1 votes scanned 2026-09-24 09:42:26.093386

View on AUR

Why flagged

The package installs a known npm package from the official npm registry; the use of a variable for the package name does not introduce risk as the source URL is clearly from npmjs.org and the checksum is provided.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs a known npm package from the official npm registry; the use of a variable for the package name does not introduce risk as the source URL is clearly from npmjs.org and the checksum is provided.

PKGBUILD:20 npm install --cache "${srcdir}/npm-cache" -g --prefix "$pkgdir/usr" "${srcdir}/${_srcname}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Felix Höffken <felix at ctrl.alt.coop>
    
      2
    
      3_npmname=@nestjs/cli
    
      4_npmver=12.0.6
    
      5_srcname="cli-${_npmver}.tgz"
    
      6pkgname=nodejs-nestjs-cli
    
      7pkgver=${_npmver}
    
      8pkgrel=0
    
      9pkgdesc="The command line interface for nestjs"
    
      10arch=(any)
    
      11url='https://docs.nestjs.com/cli/overview'
    
      12license=()
    
      13depends=('npm' 'jq' 'typescript')
    
      14optdepends=()
    
      15source=(http://registry.npmjs.org/${_npmname}/-/${_srcname})
    
      16noextract=(${_srcname})
    
      17sha256sums=('041b9af72a6ffc532e145e8387a2dd381167966062b3be9f061386818c8fbea2')
    
      18
    
      19package() {
    
      20  npm install --cache "${srcdir}/npm-cache" -g --prefix "$pkgdir/usr" "${srcdir}/${_srcname}"
    
      21  find "${pkgdir}/usr" -type d -exec chmod 755 {} +
    
      22
    
      23  # Remove references to $pkgdir
    
      24  find "$pkgdir" -type f -name package.json -print0 | xargs -0 sed -i "/_where/d"
    
      25
    
      26  # Remove references to $srcdir
    
      27  local tmppackage="$(mktemp)"
    
      28  local pkgjson="$pkgdir/usr/lib/node_modules/$_npmname/package.json"
    
      29  jq '.|=with_entries(select(.key|test("_.+")|not))' "$pkgjson" > "$tmppackage"
    
      30  mv "$tmppackage" "$pkgjson"
    
      31  chmod 644 "$pkgjson"
    
      32
    
      33  # npm gives ownership of ALL FILES to build user
    
      34  # https://bugs.archlinux.org/task/63396
    
      35  chown -R root:root "${pkgdir}"
    
      36}
    
      37
    
      38# vim:set ts=2 sw=2 et:
    
      39

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-09-24 09:42
@@ -1,7 +1,7 @@
 # Maintainer: Felix Höffken <felix at ctrl.alt.coop>
 
 _npmname=@nestjs/cli
-_npmver=11.0.23
+_npmver=12.0.6
 _srcname="cli-${_npmver}.tgz"
 pkgname=nodejs-nestjs-cli
 pkgver=${_npmver}
@@ -14,7 +14,7 @@
 optdepends=()
 source=(http://registry.npmjs.org/${_npmname}/-/${_srcname})
 noextract=(${_srcname})
-sha256sums=('903141412c33206b274dd3e186eef43782aeaff5f006db65491f2371a845e0a7')
+sha256sums=('041b9af72a6ffc532e145e8387a2dd381167966062b3be9f061386818c8fbea2')
 
 package() {
   npm install --cache "${srcdir}/npm-cache" -g --prefix "$pkgdir/usr" "${srcdir}/${_srcname}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-24 09:42:26	Low	1
2026-06-18 16:11:54	Clean	0