ny-cli

LOW

maintainer OnePunchMan 0 votes scanned 2026-10-21 19:33:05.748742

View on AUR

Why flagged

The package builds from a source tarball fetched from the project's own GitHub repository, and installs a locally built npm package; the variable-named package install is part of the normal build process and does not introduce untrusted external code.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a source tarball fetched from the project's own GitHub repository, and installs a locally built npm package; the variable-named package install is part of the normal build process and does not introduce untrusted external code.

PKGBUILD:28 npm install -g --prefix "$pkgdir/usr" "$tarball"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Anjishnu Sengupta <itsaemail@duck.com>
    
      2pkgname=ny-cli
    
      3pkgver=7.0.0
    
      4pkgrel=1
    
      5pkgdesc="Beautiful terminal anime streaming client with artwork display, cloud sync, and watch progress tracking"
    
      6arch=('any')
    
      7url="https://github.com/AnjishnuSengupta/ny-cli"
    
      8license=('MIT')
    
      9depends=('nodejs>=20.18.0' 'npm')
    
      10optdepends=(
    
      11    'mpv: recommended video player with IPC support'
    
      12    'vlc: alternative video player'
    
      13    'chafa: terminal image rendering for artwork display'
    
      14)
    
      15options=('!debug' '!strip')
    
      16source=("$pkgname-$pkgver.tar.gz::https://github.com/AnjishnuSengupta/ny-cli/archive/v$pkgver.tar.gz")
    
      17sha256sums=('SKIP')
    
      18
    
      19build() {
    
      20    cd "$srcdir/$pkgname-$pkgver"
    
      21    npm pack
    
      22}
    
      23
    
      24package() {
    
      25    cd "$srcdir/$pkgname-$pkgver"
    
      26    local tarball
    
      27    tarball=$(ls -1 anjishnusengupta-ny-cli-*.tgz 2>/dev/null | head -n 1)
    
      28    npm install -g --prefix "$pkgdir/usr" "$tarball"
    
      29
    
      30    # Set sane directory permissions
    
      31    find "$pkgdir/usr" -type d -exec chmod 755 {} +
    
      32
    
      33    # Install license and docs
    
      34    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      35    install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      36}
    
      37

Changes since previous scan

--- PKGBUILD @ 2026-09-19 17:30
+++ PKGBUILD @ 2026-10-21 19:33
@@ -1,43 +1,37 @@
 # Maintainer: Anjishnu Sengupta <itsaemail@duck.com>
 pkgname=ny-cli
-pkgver=6.4.0
+pkgver=7.0.0
 pkgrel=1
 pkgdesc="Beautiful terminal anime streaming client with artwork display, cloud sync, and watch progress tracking"
 arch=('any')
 url="https://github.com/AnjishnuSengupta/ny-cli"
 license=('MIT')
-depends=('nodejs>=18' 'npm')
+depends=('nodejs>=20.18.0' 'npm')
 optdepends=(
     'mpv: recommended video player with IPC support'
     'vlc: alternative video player'
     'chafa: terminal image rendering for artwork display'
-    'bun: enhanced terminal UI experience'
 )
+options=('!debug' '!strip')
 source=("$pkgname-$pkgver.tar.gz::https://github.com/AnjishnuSengupta/ny-cli/archive/v$pkgver.tar.gz")
 sha256sums=('SKIP')
 
+build() {
+    cd "$srcdir/$pkgname-$pkgver"
+    npm pack
+}
+
 package() {
     cd "$srcdir/$pkgname-$pkgver"
+    local tarball
+    tarball=$(ls -1 anjishnusengupta-ny-cli-*.tgz 2>/dev/null | head -n 1)
+    npm install -g --prefix "$pkgdir/usr" "$tarball"
 
-    # Install application to /usr/lib/ny-cli
-    install -d "$pkgdir/usr/lib/$pkgname"
-    install -Dm755 ny-cli "$pkgdir/usr/lib/$pkgname/ny-cli"
-    install -Dm644 backend.mjs "$pkgdir/usr/lib/$pkgname/backend.mjs"
-    install -Dm644 cli-terminal.tsx "$pkgdir/usr/lib/$pkgname/cli-terminal.tsx"
-    install -Dm644 cli-terminal-fallback.mjs "$pkgdir/usr/lib/$pkgname/cli-terminal-fallback.mjs"
-    install -Dm644 package.json "$pkgdir/usr/lib/$pkgname/package.json"
-    install -Dm644 tsconfig.json "$pkgdir/usr/lib/$pkgname/tsconfig.json" || true
-
-    # Install npm dependencies
-    cd "$pkgdir/usr/lib/$pkgname"
-    npm install --omit=dev --ignore-scripts --legacy-peer-deps 2>/dev/null || npm install --production --ignore-scripts --legacy-peer-deps 2>/dev/null
-
-    # Symlink to /usr/bin
-    install -d "$pkgdir/usr/bin"
-    ln -sf /usr/lib/$pkgname/ny-cli "$pkgdir/usr/bin/ny-cli"
+    # Set sane directory permissions
+    find "$pkgdir/usr" -type d -exec chmod 755 {} +
 
     # Install license and docs
-    install -Dm644 "$srcdir/$pkgname-$pkgver/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
-    install -Dm644 "$srcdir/$pkgname-$pkgver/README.md" "$pkgdir/usr/share/doc/$pkgname/README.md"
+    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+    install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 19:33:05	Low	1
2026-09-19 17:30:41	Clean	0
2026-07-26 05:31:42	Clean	0
2026-07-21 17:17:32	Clean	0
2026-07-19 19:12:02	Clean	0
2026-06-18 16:11:54	Clean	0