ntopng

maintainer pht · 28 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npm install commands are part of the build process for the project's own frontend assets, using devDependencies from the project's package.json; this is normal for building the application from source and does not involve installing arbitrary external code beyond what the project itself declares.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npm install commands are part of the build process for the project's own frontend assets, using devDependencies from the project's package.json; this is normal for building the application from source and does not involve installing arbitrary external code beyond what the project itself declares.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:45 npm install --save-dev @babel/core

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Barry Smith <brrtsm at gmmal dot com>
    
      2# Contributor: johnnybash <georg at grgw dot de>
    
      3# Contributor: jrdemasi <jrdemasi@gmai.com>
    
      4# Contributor: Fernando Manfredi <contact at acidhub.click>
    
      5# Contributor: Evan Teitelman <teitelmanevan at gmail dot com>
    
      6# Contributor: Ari Mizrahi <codemunchies@gmail.com>
    
      7# Contributor: CRT <cirkit@kode.email>
    
      8validpgpkeys=('EFD9413B17293AFDFE6EA6F1402A088DEDF104CB')
    
      9pkgname=ntopng
    
      10pkgver=6.6
    
      11_ndpiver=5.0
    
      12_clickhousever=2.6.0
    
      13pkgrel=1
    
      14pkgdesc='The next generation version of the original ntop, a network traffic probe that shows the network usage'
    
      15arch=('x86_64' 'i686')
    
      16url='http://www.ntop.org/'
    
      17license=('GPL-3.0-only')
    
      18depends=('valkey' 'libpcap' 'sqlite' 'libmaxminddb' 'zeromq' 'rrdtool' 'hiredis' 'curl' 'json-c')
    
      19optdepends=('net-snmp: support SNMP SET and SNMP v3')
    
      20makedepends=('glib2' 'automake' 'libtool' 'wget' 'curl' 'libxml2' 'npm' 'jq' 'python-setuptools' 'cmake')
    
      21install=$pkgname.install
    
      22source=("$pkgname-$pkgver.tar.gz::https://github.com/ntop/$pkgname/archive/$pkgver.tar.gz"
    
      23	"nDPI-$_ndpiver.tar.gz::https://github.com/ntop/nDPI/archive/$_ndpiver.tar.gz"
    
      24	"clickhouse-$_clickhousever.tar.gz::https://github.com/ClickHouse/clickhouse-cpp/archive/refs/tags/v$_clickhousever.tar.gz"
    
      25	"$pkgname@.service"
    
      26	"$pkgname.install"
    
      27	"$pkgname.sysusers")
    
      28sha512sums=('7e3f9fce3a88b245bcea6b471e2f0ed85fab7577ebfd92bd85b774a89514aa168d703057725ccedd5dbd8e00ebf4bb034e21cf0c9ad345e317c30674f832aa29'
    
      29            '9857aa654051d5b91089e6410a8a7faddf9dbd502bad21add9de035c59152031f6d130a4225fadb9738f7ef7ff37a4655300b582f6582658266b58b88c48eae3'
    
      30            '4199ac2848b0544a2a9c4e03ca62f9a14e13652b09df62b2c95eda59c567cb8227099b9cb027f18d7bdb3a25ee41f01301a551f1bf98727bf89766f5e1cac3f5'
    
      31            'b3d9a2032cce91ee4faf81522a30a2877540b3fc7a0d43f8fe4f01c16efb0b8f6e73cfe26028b3a070296d7156abf511d3e11f93635ca2de8a4d67322b0ade60'
    
      32            '3e9c2af59c429d18e345cde23d21888524040626db80250dca7a308554aa6e0f580df6cdd553e0ae33942deefa136f0853dbdc93c248f88a17b6b87b63388be1'
    
      33            'bb7f81a43e6bd1d58e41693dca1b5f03e507fb040bf036a5847a273f55bcfa665e8512220a54495c2926afb64e786d4e666556d7880be432cc7660de105e3ee4')
    
      34
    
      35build() {
    
      36  mv $srcdir/clickhouse-cpp-$_clickhousever/* $srcdir/ntopng-$pkgver/third-party/clickhouse-cpp/
    
      37  cd $srcdir/nDPI-$_ndpiver
    
      38  ./autogen.sh
    
      39  ./configure
    
      40  make
    
      41  export NDPI_HOME=$srcdir/nDPI-$_ndpiver
    
      42  cd $srcdir/$pkgname-$pkgver
    
      43  ./autogen.sh
    
      44  ./configure --prefix=$pkgdir/usr --datadir=/usr/share
    
      45  npm install --save-dev @babel/core
    
      46  jq -c '.devDependencies' package.json | jq -r -M | grep ':' | sed 's/:/@/' | sed 's|[", ^]||g' | npm install --save-dev
    
      47  npm run build:dev
    
      48  make
    
      49}
    
      50
    
      51package() {
    
      52  cd $srcdir/$pkgname-$pkgver
    
      53
    
      54  make install
    
      55
    
      56  mv $pkgdir/usr/{man,share/}
    
      57  install -Dm644 "$srcdir/$pkgname@.service" "$pkgdir/usr/lib/systemd/system/$pkgname@.service"
    
      58  install -Dm644 "$srcdir/$pkgname.sysusers" "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2