nodejs-perlnavigator-server
LOW
maintainer Kharec
2 votes
base
perlnavigator
scanned 2026-10-23 00:02:19.781852
Why flagged
The npx command is used to run 'tsc' (TypeScript compiler) during the build process, which is a standard development tool and not an execution of untrusted remote code; the source is from a legitimate GitHub repository and the build is reproducible.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command is used to run 'tsc' (TypeScript compiler) during the build process, which is a standard development tool and not an execution of untrusted remote code; the source is from a legitimate GitHub repository and the build is reproducible.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:63
npx tsc
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Beini <bane at iki dot fi>
2
pkgname=('perlnavigator'
3
'nodejs-perl-navigator-web-server'
4
'nodejs-perlnavigator-client'
5
'nodejs-perlnavigator-server'
6
)
7
pkgbase=perlnavigator
8
_pkgname=PerlNavigator
9
pkgver=0.8.20
10
pkgrel=2
11
pkgdesc="Perl language server that includes syntax checking, perl critic, and code navigation"
12
arch=('any')
13
url="https://github.com/bscan/PerlNavigator"
14
license=('MIT')
15
makedepends=('npm' 'jq')
16
source=(
17
"${pkgbase}-${pkgver}.tar.gz::https://github.com/bscan/${_pkgname}/archive/refs/tags/v${pkgver}.tar.gz")
18
b2sums=('3ae6507d51f68816d6503cfcfde068fe5c5b9e787c93e6856acaa271cbd5fe21eb083aca748c62035eafb3871a458721bfb0b2b913ed72b3e44dab7d8ea7e140')
19
20
_package_node_subdir(){
21
local subdir=$1
22
23
cd "${_pkgname}-${pkgver}"
24
25
npm install -g \
26
--cache "${srcdir}/npm-cache" \
27
--prefix "${pkgdir}/usr" \
28
--install-links "./$subdir"
29
30
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
31
32
find "${pkgdir}/usr" -type d -exec chmod 755 {} +
33
34
chown -R root:root "${pkgdir}"
35
36
find "${pkgdir}" -type f -name "package.json" -print0 \
37
| xargs -0 sed -i "/_where/d"
38
39
local tmppackage="$(mktemp)"
40
local pkgjson="${pkgdir}/usr/lib/node_modules/${pkgname#nodejs-}/package.json"
41
jq '.|=with_entries(select(.key|test("_.+")|not))' "${pkgjson}" > "${tmppackage}"
42
mv "${tmppackage}" "${pkgjson}"
43
chmod 644 "${pkgjson}"
44
}
45
46
prepare() {
47
cd "${_pkgname}-${pkgver}"
48
npm ci --cache "${srcdir}/npm-cache" --ignore-scripts
49
50
local subdir
51
for subdir in browser-ext client server
52
do
53
pushd $subdir
54
npm ci --cache "${srcdir}/npm-cache"
55
popd
56
done
57
}
58
59
build() {
60
cd "${_pkgname}-${pkgver}"
61
npm run ci-all
62
cd server
63
npx tsc
64
}
65
66
package_perlnavigator() {
67
pkgdesc="Perl language server that includes syntax checking, perl critic, and code navigation. Self-contained executable"
68
arch=('x86_64' 'aarch64')
69
depends=('glibc' 'gcc-libs')
70
# Both provide /usr/bin/perlnavigator
71
conflicts=('nodejs-perlnavigator-server')
72
options=("!strip")
73
74
cd "${_pkgname}-${pkgver}"
75
install -d "${pkgdir}/usr/lib/node_modules"
76
cp -a server "${pkgdir}/usr/lib/node_modules/perlnavigator-server"
77
78
install -d "${pkgdir}/usr/bin"
79
ln -s ../lib/node_modules/perlnavigator-server/bin/perlnavigator \
80
"${pkgdir}/usr/bin/perlnavigator"
81
82
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
83
}
84
85
package_nodejs-perl-navigator-web-server() {
86
pkgdesc="Perl language server implementation in a web extension"
87
depends=("nodejs")
88
89
_package_node_subdir browser-ext
90
}
91
92
package_nodejs-perlnavigator-client() {
93
pkgdesc="Perl language server client"
94
depends=("bash" "nodejs")
95
96
_package_node_subdir client
97
}
98
99
package_nodejs-perlnavigator-server() {
100
depends=("nodejs")
101
provides=('perlnavigator')
102
conflicts=('perlnavigator')
103
104
_package_node_subdir server
105
}
106
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |