omniroute

maintainer catHeadCoffee · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx usage is for rebuilding a native module (better-sqlite3) from source within the project's own dependency tree, not executing arbitrary remote code; the package builds from a legitimate npm source with no evidence of malicious payloads or supply-chain redirection.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx usage is for rebuilding a native module (better-sqlite3) from source within the project's own dependency tree, not executing arbitrary remote code; the package builds from a legitimate npm source with no evidence of malicious payloads or supply-chain redirection.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:62 (cd node_modules/better-sqlite3 && npx --yes node-gyp rebuild) 2>&1 || true

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: coffee <catheadcoffee@gmail.com>
    
      2# Contributor: diegosouzapw
    
      3#
    
      4# OmniRoute — Unified AI router
    
      5#
    
      6# Package notes:
    
      7# - npm tarball 155MB compressed, ~740MB installed (includes prebuilt
    
      8#   Next.js standalone under dist/ with bundled node_modules).
    
      9# - Native modules (better-sqlite3, wreq-js) must be compiled for THIS
    
      10#   system because the bundled dist binaries use a different glibc.
    
      11# - Build: install deps with --ignore-scripts (avoids "prepare: husky"
    
      12#   failure since husky is a devDep), then manually rebuild native
    
      13#   modules, copy to dist/node_modules/, and run sync-env.
    
      14# - Package: install from repacked tarball (avoids npm --prefix
    
      15#   symlink-vs-copy pitfall).
    
      16
    
      17pkgname=omniroute
    
      18pkgver=3.8.49
    
      19pkgrel=1
    
      20pkgdesc='Unified AI router with 160+ providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs.'
    
      21arch=('x86_64')
    
      22url='https://omniroute.online'
    
      23license=('MIT')
    
      24depends=('nodejs>=22')
    
      25options=('!strip' '!emptydirs')
    
      26optdepends=(
    
      27  'nodejs-better-sqlite3: SQLite storage for local data'
    
      28)
    
      29makedepends=('npm')
    
      30source=("https://registry.npmjs.org/${pkgname}/-/${pkgname}-${pkgver}.tgz")
    
      31sha256sums=('7dc1ac03139dbf5652c2ddb878726ef7b9724404ca070f2b61e16f193461c58b')
    
      32
    
      33build() {
    
      34  cd "${srcdir}"
    
      35
    
      36  # Extract npm tarball (registry tarballs extract to package/)
    
      37  tar xzf "${pkgname}-${pkgver}.tgz"
    
      38
    
      39  cd package
    
      40
    
      41  # Install prod deps (--omit=dev) with --ignore-scripts to avoid:
    
      42  #   1. "prepare: husky" failure — husky is a devDep, not installed
    
      43  #      with --omit=dev, so the postinstall's prepare step fails.
    
      44  #   2. postinstall's npm rebuild in dist/node_modules/ being blocked
    
      45  #      by npm's allowScripts mechanism.
    
      46  npm install \
    
      47    --omit=dev \
    
      48    --no-audit \
    
      49    --no-fund \
    
      50    --legacy-peer-deps \
    
      51    --ignore-scripts
    
      52
    
      53  # ---- Rebuild native modules from source ----
    
      54  # The bundled dist/node_modules/ binaries were compiled against a
    
      55  # different glibc (Ubuntu CI) and won't load on this system.
    
      56  # npm's allowScripts blocks rebuild in the dist context, so we
    
      57  # rebuild in the root context and manually copy to dist.
    
      58  # Use subshells to avoid polluting the parent shell's CWD.
    
      59
    
      60  # better-sqlite3
    
      61  echo "  🔧 Rebuilding better-sqlite3..."
    
      62  (cd node_modules/better-sqlite3 && npx --yes node-gyp rebuild) 2>&1 || true
    
      63  if [ -f node_modules/better-sqlite3/build/Release/better_sqlite3.node ]; then
    
      64    mkdir -p dist/node_modules/better-sqlite3/build/Release/
    
      65    cp node_modules/better-sqlite3/build/Release/better_sqlite3.node \
    
      66       dist/node_modules/better-sqlite3/build/Release/
    
      67    echo "  ✅ better-sqlite3 binary copied to dist"
    
      68  fi
    
      69
    
      70  # Run the env setup that postinstall normally handles.
    
      71  # sync-env.mjs at scripts/dev/sync-env.mjs (2 levels deep) but
    
      72  # resolveRootDir() only dirname(dirname()) gives scripts/ instead of
    
      73  # package root. Pass explicit rootDir via import.
    
      74  node -e "
    
      75    import('./scripts/dev/sync-env.mjs').then(m => {
    
      76      m.syncEnv({rootDir: process.cwd()})
    
      77    })
    
      78  " 2>&1 || true
    
      79
    
      80  cd "${srcdir}"
    
      81
    
      82  # Clean node-gyp build artifacts (contain $srcdir references)
    
      83  rm -rf package/node_modules/better-sqlite3/build 2>/dev/null || true
    
      84
    
      85  # Repack into self-contained tarball — avoids npm --prefix's
    
      86  # symlink-vs-copy pitfall when installing from a directory.
    
      87  rm -rf "pkg-${pkgver}"
    
      88  mv package "pkg-${pkgver}"
    
      89  tar czf "pkg-${pkgver}-bundle.tgz" "pkg-${pkgver}"
    
      90}
    
      91
    
      92package() {
    
      93  cd "${srcdir}"
    
      94
    
      95  # Install from repacked tarball — npm extracts and copies, no symlinks
    
      96  # (the symlink pitfall only happens when installing from a directory).
    
      97  npm install \
    
      98    --global \
    
      99    --prefix "${pkgdir}/usr" \
    
      100    --no-audit \
    
      101    --no-fund \
    
      102    "pkg-${pkgver}-bundle.tgz"
    
      103
    
      104  # Clean npm's leftover config artifacts
    
      105  rm -rf "${pkgdir}/usr/etc" 2>/dev/null || true
    
      106}
    
      107

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -15,7 +15,7 @@
 #   symlink-vs-copy pitfall).
 
 pkgname=omniroute
-pkgver=3.8.48
+pkgver=3.8.49
 pkgrel=1
 pkgdesc='Unified AI router with 160+ providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs.'
 arch=('x86_64')
@@ -28,7 +28,7 @@
 )
 makedepends=('npm')
 source=("https://registry.npmjs.org/${pkgname}/-/${pkgname}-${pkgver}.tgz")
-sha256sums=('SKIP')
+sha256sums=('7dc1ac03139dbf5652c2ddb878726ef7b9724404ca070f2b61e16f193461c58b')
 
 build() {
   cd "${srcdir}"
@@ -38,13 +38,13 @@
 
   cd package
 
-  # Install production deps with --ignore-scripts to avoid:
+  # Install prod deps (--omit=dev) with --ignore-scripts to avoid:
   #   1. "prepare: husky" failure — husky is a devDep, not installed
-  #      with --production, so the postinstall's prepare step fails.
+  #      with --omit=dev, so the postinstall's prepare step fails.
   #   2. postinstall's npm rebuild in dist/node_modules/ being blocked
   #      by npm's allowScripts mechanism.
   npm install \
-    --production \
+    --omit=dev \
     --no-audit \
     --no-fund \
     --legacy-peer-deps \

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 17:15:21	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 01:20:27	MEDIUM	3
2026-07-22 01:18:42	MEDIUM	2