omniroute

LOW

maintainer catHeadCoffee 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx usage is for rebuilding a native module (better-sqlite3) from source within the build process; it does not execute arbitrary remote code or install untrusted packages beyond the project's declared dependencies.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx usage is for rebuilding a native module (better-sqlite3) from source within the build process; it does not execute arbitrary remote code or install untrusted packages beyond the project's declared dependencies.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:62 (cd node_modules/better-sqlite3 && npx --yes node-gyp rebuild) 2>&1 || true

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: coffee <catheadcoffee@gmail.com>
    
      2# Contributor: diegosouzapw
    
      3#
    
      4# OmniRoute — Unified AI router
    
      5#
    
      6# Package notes:
    
      7# - npm tarball 155MB compressed, ~740MB installed (includes prebuilt
    
      8#   Next.js standalone under dist/ with bundled node_modules).
    
      9# - Native modules (better-sqlite3, wreq-js) must be compiled for THIS
    
      10#   system because the bundled dist binaries use a different glibc.
    
      11# - Build: install deps with --ignore-scripts (avoids "prepare: husky"
    
      12#   failure since husky is a devDep), then manually rebuild native
    
      13#   modules, copy to dist/node_modules/, and run sync-env.
    
      14# - Package: install from repacked tarball (avoids npm --prefix
    
      15#   symlink-vs-copy pitfall).
    
      16
    
      17pkgname=omniroute
    
      18pkgver=3.8.50
    
      19pkgrel=1
    
      20pkgdesc='Unified AI router with 160+ providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs.'
    
      21arch=('x86_64')
    
      22url='https://omniroute.online'
    
      23license=('MIT')
    
      24depends=('nodejs>=22')
    
      25options=('!strip' '!emptydirs')
    
      26optdepends=(
    
      27  'nodejs-better-sqlite3: SQLite storage for local data'
    
      28)
    
      29makedepends=('npm')
    
      30source=("https://registry.npmjs.org/${pkgname}/-/${pkgname}-${pkgver}.tgz")
    
      31sha256sums=('738c58af1faae8c57eb643a939d1191f8d7e083d9295ef61687d2bff04878c29')
    
      32
    
      33build() {
    
      34  cd "${srcdir}"
    
      35
    
      36  # Extract npm tarball (registry tarballs extract to package/)
    
      37  tar xzf "${pkgname}-${pkgver}.tgz"
    
      38
    
      39  cd package
    
      40
    
      41  # Install prod deps (--omit=dev) with --ignore-scripts to avoid:
    
      42  #   1. "prepare: husky" failure — husky is a devDep, not installed
    
      43  #      with --omit=dev, so the postinstall's prepare step fails.
    
      44  #   2. postinstall's npm rebuild in dist/node_modules/ being blocked
    
      45  #      by npm's allowScripts mechanism.
    
      46  npm install \
    
      47    --omit=dev \
    
      48    --no-audit \
    
      49    --no-fund \
    
      50    --legacy-peer-deps \
    
      51    --ignore-scripts
    
      52
    
      53  # ---- Rebuild native modules from source ----
    
      54  # The bundled dist/node_modules/ binaries were compiled against a
    
      55  # different glibc (Ubuntu CI) and won't load on this system.
    
      56  # npm's allowScripts blocks rebuild in the dist context, so we
    
      57  # rebuild in the root context and manually copy to dist.
    
      58  # Use subshells to avoid polluting the parent shell's CWD.
    
      59
    
      60  # better-sqlite3
    
      61  echo "  🔧 Rebuilding better-sqlite3..."
    
      62  (cd node_modules/better-sqlite3 && npx --yes node-gyp rebuild) 2>&1 || true
    
      63  if [ -f node_modules/better-sqlite3/build/Release/better_sqlite3.node ]; then
    
      64    mkdir -p dist/node_modules/better-sqlite3/build/Release/
    
      65    cp node_modules/better-sqlite3/build/Release/better_sqlite3.node \
    
      66       dist/node_modules/better-sqlite3/build/Release/
    
      67    echo "  ✅ better-sqlite3 binary copied to dist"
    
      68  fi
    
      69
    
      70  # Run the env setup that postinstall normally handles.
    
      71  # sync-env.mjs at scripts/dev/sync-env.mjs (2 levels deep) but
    
      72  # resolveRootDir() only dirname(dirname()) gives scripts/ instead of
    
      73  # package root. Pass explicit rootDir via import.
    
      74  node -e "
    
      75    import('./scripts/dev/sync-env.mjs').then(m => {
    
      76      m.syncEnv({rootDir: process.cwd()})
    
      77    })
    
      78  " 2>&1 || true
    
      79
    
      80  cd "${srcdir}"
    
      81
    
      82  # Clean node-gyp build artifacts (contain $srcdir references)
    
      83  rm -rf package/node_modules/better-sqlite3/build 2>/dev/null || true
    
      84
    
      85  # Repack into self-contained tarball — avoids npm --prefix's
    
      86  # symlink-vs-copy pitfall when installing from a directory.
    
      87  rm -rf "pkg-${pkgver}"
    
      88  mv package "pkg-${pkgver}"
    
      89  tar czf "pkg-${pkgver}-bundle.tgz" "pkg-${pkgver}"
    
      90}
    
      91
    
      92package() {
    
      93  cd "${srcdir}"
    
      94
    
      95  # Install from repacked tarball — npm extracts and copies, no symlinks
    
      96  # (the symlink pitfall only happens when installing from a directory).
    
      97  npm install \
    
      98    --global \
    
      99    --prefix "${pkgdir}/usr" \
    
      100    --no-audit \
    
      101    --no-fund \
    
      102    "pkg-${pkgver}-bundle.tgz"
    
      103
    
      104  # Clean npm's leftover config artifacts
    
      105  rm -rf "${pkgdir}/usr/etc" 2>/dev/null || true
    
      106}
    
      107

Changes since previous scan

--- PKGBUILD @ 2026-09-10 00:22
+++ PKGBUILD @ 2026-09-17 00:27
@@ -15,7 +15,7 @@
 #   symlink-vs-copy pitfall).
 
 pkgname=omniroute
-pkgver=3.8.49
+pkgver=3.8.50
 pkgrel=1
 pkgdesc='Unified AI router with 160+ providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs.'
 arch=('x86_64')
@@ -28,7 +28,7 @@
 )
 makedepends=('npm')
 source=("https://registry.npmjs.org/${pkgname}/-/${pkgname}-${pkgver}.tgz")
-sha256sums=('7dc1ac03139dbf5652c2ddb878726ef7b9724404ca070f2b61e16f193461c58b')
+sha256sums=('738c58af1faae8c57eb643a939d1191f8d7e083d9295ef61687d2bff04878c29')
 
 build() {
   cd "${srcdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 15:20:39	Medium	1
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 01:44:31	Medium	1
2026-08-31 00:19:57	Low	2