openbazaar-git

LOW

maintainer robertfoster 10 votes scanned 2026-11-02 00:26:00.633185

View on AUR

Why flagged

The PKGBUILD pulls from the official GitHub repository of OpenBazaar (a known open-source project) and runs npm install from the standard npm registry. The 'npm install --save node-sass@5.0.0' installs a well-known, widely-used npm package (node-sass) at a pinned version from the official npm registry — this is a standard pattern for fixing build-time dependency compatibility issues. While npm installs do carry inherent supply-chain risk (no checksums on transitive deps), this is a common and accepted AUR pattern for Node.js/Electron applications. The node-sass package itself is a legitimate, popular package. There is no unofficial or personal host involved, no binary blobs from untrusted sources, and no obfuscation. The main concern is the general lack of lockfile/checksum verification for npm dependencies, which is a low-severity sloppy packaging issue rather than a genuine supply-chain attack vector.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The PKGBUILD pulls from the official GitHub repository of OpenBazaar (a known open-source project) and runs npm install from the standard npm registry. The 'npm install --save node-sass@5.0.0' installs a well-known, widely-used npm package (node-sass) at a pinned version from the official npm registry — this is a standard pattern for fixing build-time dependency compatibility issues. While npm installs do carry inherent supply-chain risk (no checksums on transitive deps), this is a common and accepted AUR pattern for Node.js/Electron applications. The node-sass package itself is a legitimate, popular package. There is no unofficial or personal host involved, no binary blobs from untrusted sources, and no obfuscation. The main concern is the general lack of lockfile/checksum verification for npm dependencies, which is a low-severity sloppy packaging issue rather than a genuine supply-chain attack vector.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:24 npm install --save node-sass@5.0.0

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: robertfoster
    
      2
    
      3pkgname=openbazaar-git
    
      4pkgver=v2.4.10.r0.gf724cf15
    
      5pkgrel=1
    
      6pkgdesc="Front-end Electron application for talking with the OpenBazaar daemon (Latest devel version)"
    
      7arch=(i686 x86_64)
    
      8url="https://github.com/OpenBazaar/openbazaar-desktop"
    
      9license=('MIT')
    
      10depends=('electron6')
    
      11optdepends=('openbazaard-git: server daemon occasionally needed by front-end')
    
      12makedepends=('git' 'npm')
    
      13conflicts=('openbazaar')
    
      14source=("${pkgname%%-git}::git+https://github.com/OpenBazaar/openbazaar-desktop.git"
    
      15  "${pkgname%%-git}.js"
    
      16  "${pkgname%%-git}.desktop"
    
      17)
    
      18install=${pkgname%%-git}.install
    
      19options=('!strip')
    
      20
    
      21prepare() {
    
      22  cd $srcdir/${pkgname%%-git}
    
      23  sed -i '/electron/d' package.json
    
      24  npm install --save node-sass@5.0.0
    
      25  npm install --silent
    
      26}
    
      27
    
      28build() {
    
      29  cd $srcdir/${pkgname%%-git}
    
      30  npm run build
    
      31}
    
      32
    
      33package() {
    
      34  cd $srcdir
    
      35  appdir="usr/lib/${pkgname%%-git}"
    
      36
    
      37  install -d $pkgdir/${appdir%%/${pkgname%%-git}}
    
      38  cp -rf ${pkgname%%-git} $pkgdir/$appdir
    
      39  install -Dm755 ${pkgname%%-git}.js $pkgdir/usr/bin/${pkgname%%-git}
    
      40  install -Dm644 ${pkgname%%-git}/imgs/icon.png $pkgdir/usr/share/pixmaps/${pkgname%%-git}2.png
    
      41  install -Dm644 ${pkgname%%-git}.desktop $pkgdir/usr/share/applications/${pkgname%%-git}.desktop
    
      42
    
      43  cd $pkgdir/$appdir
    
      44  rm -rf .git*
    
      45  rm -rf .travis
    
      46  cp -rf prod/* js/
    
      47  find "${pkgdir}"/${appdir} \
    
      48    -name "bin" -prune -exec rm -r '{}' \; \
    
      49    -or -name "example" -prune -exec rm -r '{}' \; \
    
      50    -or -name "examples" -prune -exec rm -r '{}' \; \
    
      51    -or -name "test" -prune -exec rm -r '{}' \;
    
      52  pathtoreplace=$(echo ${srcdir}/ | sed 's:/:\\\/:g')
    
      53  find "$pkgdir/$appdir/node_modules/" -name "*.json" -exec \
    
      54    sed -i "s/$pathtoreplace//g" {} +
    
      55}
    
      56
    
      57pkgver() {
    
      58  cd $srcdir/${pkgname%%-git}
    
      59  git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      60}
    
      61
    
      62md5sums=('SKIP'
    
      63  '8359716a04cff2fd8499406408b6c590'
    
      64  'a278f17aa965510cadb534df49b245dd')
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Low	2
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2