nodejs-node-red
LOW
maintainer ChaosKid42
15 votes
scanned 2026-09-09 00:04:09.106193
Why flagged
The package uses npm to install a Node.js module from the official npm registry, which is a standard and expected practice for Node.js packages; the variable name does not introduce risk as it resolves to the declared upstream source.
Triggered rules
Low
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package uses npm to install a Node.js module from the official npm registry, which is a standard and expected practice for Node.js packages; the variable name does not introduce risk as it resolves to the declared upstream source.
-
PKGBUILD:38
npm install --cache "${srcdir}/npm-cache" --global --prefix "${pkgdir}/usr" "${_npmname}@${pkgver}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Christoph Scholz <christoph.scholz@gmail.com>
2
_npmname=node-red
3
pkgver=5.0.7
4
pkgname=nodejs-${_npmname}
5
pkgrel=1
6
pkgdesc="A visual tool for wiring the Internet of Things."
7
arch=(x86_64 i686 armv5 armv6h armv7h aarch64)
8
url="https://nodered.org"
9
license=("APACHE")
10
depends=("nodejs>=22" "npm")
11
makedepends=('desktop-file-utils' 'gendesk')
12
optdepends=()
13
backup=("etc/default/${pkgname}")
14
source=("https://registry.npmjs.org/${_npmname}/-/${_npmname}-${pkgver}.tgz"
15
"${pkgname}.service"
16
"${pkgname}.default")
17
noextract=("${_npmname}-${pkgver}.tgz")
18
sha256sums=('e701362fda8930bba62a138276f147c21fcbeb61fb9778d6d130467f6d02e753'
19
'cb3468c4f5c5883ed89aef13485c6c604d22f917cec714585dbadd4914fff3e8'
20
'd08994475b06f270b2f1a2b3c99c22fd33f001dc2a10413460caded125f81f38')
21
22
prepare() {
23
gendesk -f -n \
24
--pkgname="${pkgname}" \
25
--pkgdesc="${pkgdesc}" \
26
--name="Node-RED" \
27
--exec="${_npmname}" \
28
--icon="${_npmname}" \
29
--terminal=true \
30
--categories="Development"
31
}
32
33
package() {
34
install -Dm644 ${pkgname}.default "${pkgdir}/etc/default/${pkgname}"
35
install -Dm644 ${pkgname}.service "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
36
mkdir -p ${pkgdir}/usr/lib/node_modules
37
cd ${pkgdir}/usr/lib/node_modules
38
npm install --cache "${srcdir}/npm-cache" --global --prefix "${pkgdir}/usr" "${_npmname}@${pkgver}"
39
echo "u ${pkgname} - - /var/lib/${pkgname}" | install -Dm644 /dev/stdin "${pkgdir}"/usr/lib/sysusers.d/"${pkgname}".conf
40
echo "d /var/lib/${pkgname} 0750 ${pkgname} ${pkgname} -" | install -Dm644 /dev/stdin "${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
41
mkdir -p ${pkgdir}/usr/share/icons/hicolor/scalable/apps
42
ln -s /usr/lib/node_modules/node-red/node_modules/@node-red/editor-client/public/red/images/node-red.svg ${pkgdir}/usr/share/icons/hicolor/scalable/apps/${_npmname}.svg
43
install -Dm644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
44
}
45
Changes since previous scan
--- PKGBUILD @ 2026-09-02 05:49+++ PKGBUILD @ 2026-09-09 00:04@@ -1,6 +1,6 @@ # Maintainer: Christoph Scholz <christoph.scholz@gmail.com> _npmname=node-red-pkgver=5.0.5+pkgver=5.0.7 pkgname=nodejs-${_npmname} pkgrel=1 pkgdesc="A visual tool for wiring the Internet of Things."@@ -15,7 +15,7 @@ "${pkgname}.service" "${pkgname}.default") noextract=("${_npmname}-${pkgver}.tgz")-sha256sums=('d835861a63ed988c7b93713c7810340ef9988a3313b86f40b08f3e8adcbcd006'+sha256sums=('e701362fda8930bba62a138276f147c21fcbeb61fb9778d6d130467f6d02e753' 'cb3468c4f5c5883ed89aef13485c6c604d22f917cec714585dbadd4914fff3e8' 'd08994475b06f270b2f1a2b3c99c22fd33f001dc2a10413460caded125f81f38') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-09 00:04:09 | Low | 1 |
| 2026-09-08 17:18:20 | Low | 1 |
| 2026-09-02 05:49:42 | Clean | 1 |
| 2026-09-01 15:48:43 | Clean | 1 |
| 2026-07-31 07:17:22 | Clean | 1 |
| 2026-07-30 11:14:12 | Clean | 1 |
| 2026-07-02 06:44:17 | Clean | 1 |
| 2026-06-18 16:11:54 | Clean | 0 |