opencode-quota
LOW
maintainer lapsus
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package installs Node.js dependencies from npmjs.org, which is a trusted registry; the use of a variable in package installation is part of normal npm workflow and does not introduce untrusted code execution, as sources are pinned and checksummed.
Triggered rules
Low
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs Node.js dependencies from npmjs.org, which is a trusted registry; the use of a variable in package installation is part of normal npm workflow and does not introduce untrusted code execution, as sources are pinned and checksummed.
-
PKGBUILD:34
npm install --prefix "$srcdir/peer-root" --omit=dev --ignore-scripts --legacy-peer-deps "${_peerdeps[@]}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
pkgname=opencode-quota
3
_npmname=@slkiser/opencode-quota
4
pkgver=6.0.0
5
pkgrel=1
6
pkgdesc="OpenCode plugin for quota & token usage tracking with zero context window pollution"
7
arch=('x86_64')
8
url="https://github.com/slkiser/opencode-quota"
9
license=('MIT')
10
depends=('gcc-libs' 'nodejs' 'opencode')
11
makedepends=('npm')
12
options=('!debug')
13
install=$pkgname.install
14
15
source=("$pkgname-$pkgver.tgz::https://registry.npmjs.org/$_npmname/-/$pkgname-$pkgver.tgz")
16
sha256sums=('d777c6e32baadb8e2c9c02be50c39d4622dae3df9fd8a3724ac188232172f178')
17
18
latestver() {
19
curl -fsSL "https://registry.npmjs.org/$_npmname/latest" | jq -r '.version'
20
}
21
22
package() {
23
cd "$srcdir/package"
24
25
npm install --omit=dev --omit=peer --ignore-scripts --legacy-peer-deps
26
27
mapfile -t _peerdeps < <(node -e '
28
const pkg = require("./package.json");
29
for (const [name, range] of Object.entries(pkg.peerDependencies ?? {}))
30
console.log(`${name}@${range}`);
31
')
32
if ((${#_peerdeps[@]})); then
33
rm -rf "$srcdir/peer-root"
34
npm install --prefix "$srcdir/peer-root" --omit=dev --ignore-scripts --legacy-peer-deps "${_peerdeps[@]}"
35
cp -a "$srcdir/peer-root/node_modules/." node_modules/
36
fi
37
38
# The plugin reads its store through node:sqlite (bun:sqlite under Bun), so
39
# gate the build on the runtime actually providing it.
40
node -e '
41
const {DatabaseSync} = require("node:sqlite");
42
const db = new DatabaseSync(":memory:");
43
db.exec("create table t(a)");
44
db.prepare("insert into t values (?)").run(1);
45
console.log("node:sqlite exercised:", db.prepare("select a from t").get().a);
46
'
47
48
# Remove build tools pulled in by npm resolution (not needed at runtime).
49
# node-gyp rides along in the tree with its bundled gyp/packaging python
50
# sources; nothing imports it at load time (msgpackr resolves its prebuilt
51
# binding through node-gyp-build), and shipping it makes namcap demand a
52
# python runtime dep for a plugin that never compiles anything.
53
rm -rf node_modules/.bin node_modules/node-gyp
54
rm -f node_modules/@msgpackr-extract/msgpackr-extract-linux-x64/*.musl.node
55
rm -rf node_modules/@opentui/core/lib/tree-sitter/assets
56
rm -f node_modules/@opentui/core/lib/tree-sitter/update-assets.js node_modules/@opentui/core/lib/tree-sitter/update-assets.d.ts
57
rm -rf node_modules/jsesc/man node_modules/marked/man node_modules/cssesc/man
58
59
install -d "$pkgdir/usr/lib/opencode/plugins/$pkgname"
60
cp -r . "$pkgdir/usr/lib/opencode/plugins/$pkgname/"
61
chmod 755 "$pkgdir/usr/lib/opencode/plugins/$pkgname/dist/bin/opencode-quota.js"
62
install -d "$pkgdir/usr/bin"
63
ln -s "/usr/lib/opencode/plugins/$pkgname/dist/bin/opencode-quota.js" "$pkgdir/usr/bin/opencode-quota"
64
65
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
66
}
67
Changes since previous scan
--- PKGBUILD @ 2026-10-17 15:18+++ PKGBUILD @ 2026-11-01 00:21@@ -1,7 +1,7 @@ # Maintainer: Yakov Till <yakov.till@gmail.com> pkgname=opencode-quota _npmname=@slkiser/opencode-quota-pkgver=5.0.3+pkgver=6.0.0 pkgrel=1 pkgdesc="OpenCode plugin for quota & token usage tracking with zero context window pollution" arch=('x86_64')@@ -13,7 +13,7 @@ install=$pkgname.install source=("$pkgname-$pkgver.tgz::https://registry.npmjs.org/$_npmname/-/$pkgname-$pkgver.tgz")-sha256sums=('cfeb1cc6584d2e594c00969b2d440118ddfba0c50eff8e840c3d92d912a102e4')+sha256sums=('d777c6e32baadb8e2c9c02be50c39d4622dae3df9fd8a3724ac188232172f178') latestver() { curl -fsSL "https://registry.npmjs.org/$_npmname/latest" | jq -r '.version'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 1 |
| 2026-10-31 00:07:41 | Low | 1 |
| 2026-10-30 00:29:30 | Low | 1 |
| 2026-10-29 00:13:55 | Low | 1 |
| 2026-10-28 00:06:54 | Low | 1 |
| 2026-10-27 03:46:34 | Low | 1 |
| 2026-10-17 15:18:35 | Clean | 1 |
| 2026-10-17 00:21:55 | Low | 1 |
| 2026-10-16 00:12:47 | Low | 1 |
| 2026-10-15 00:28:05 | Low | 1 |
| 2026-10-14 00:06:47 | Low | 1 |
| 2026-10-13 00:23:45 | Low | 1 |
| 2026-10-12 00:18:51 | Low | 1 |
| 2026-10-11 00:26:05 | Low | 1 |
| 2026-10-10 00:11:52 | Low | 1 |
| 2026-10-09 00:05:33 | Low | 1 |
| 2026-10-08 00:28:03 | Low | 1 |
| 2026-10-07 00:21:34 | Low | 1 |
| 2026-10-07 00:04:18 | Low | 1 |
| 2026-10-06 00:13:36 | Low | 1 |