nudnik

maintainer salosh · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD uses 'pip install' to fetch the nudnik package directly from PyPI at build time with no source array, no checksums, and no integrity verification. This is a genuine supply-chain concern: any future compromise or replacement of the nudnik PyPI package would be silently installed without any hash validation. Additionally, pip is run outside of the normal makepkg source verification framework, bypassing Arch's standard integrity checks entirely. While PyPI is a legitimate ecosystem mirror, pulling and executing arbitrary Python code from it without pinned hashes or checksums is a real medium-severity supply-chain risk, not a false positive.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:27 pip install --no-deps --target="nudnik" nudnik==0.0.26

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD uses 'pip install' to fetch the nudnik package directly from PyPI at build time with no source array, no checksums, and no integrity verification. This is a genuine supply-chain concern: any future compromise or replacement of the nudnik PyPI package would be silently installed without any hash validation. Additionally, pip is run outside of the normal makepkg source verification framework, bypassing Arch's standard integrity checks entirely. While PyPI is a legitimate ecosystem mirror, pulling and executing arbitrary Python code from it without pinned hashes or checksums is a real medium-severity supply-chain risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Salo Shp <support@salosh.org>
    
      2pkgname=nudnik
    
      3pkgver=0.0.26
    
      4pkgrel=1
    
      5epoch=
    
      6pkgdesc="gRPC load-balancing testing tool"
    
      7arch=(any)
    
      8url="https://github.com/salosh/nudnik.git"
    
      9license=(GPLv3)
    
      10groups=()
    
      11depends=()
    
      12makedepends=("python" "python-pip")
    
      13checkdepends=()
    
      14optdepends=()
    
      15provides=()
    
      16conflicts=()
    
      17replaces=()
    
      18backup=()
    
      19options=()
    
      20install=
    
      21changelog=
    
      22noextract=()
    
      23md5sums=()
    
      24validpgpkeys=()
    
      25
    
      26build() {
    
      27  pip install --no-deps --target="nudnik" nudnik==0.0.26
    
      28}
    
      29
    
      30package() {
    
      31  sitepackages=$(python -c "import site; print(site.getsitepackages()[0])")
    
      32  mkdir -p $pkgdir/"$sitepackages"
    
      33  cp -r $srcdir/nudnik/* $pkgdir/"$sitepackages"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2