opencode-quota
maintainer lapsus
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package installs a Node.js plugin from the official npm registry, which is a trusted source; the use of a variable in npm install is standard for peer dependencies and does not introduce untrusted code execution.
Triggered rules
LOW
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs a Node.js plugin from the official npm registry, which is a trusted source; the use of a variable in npm install is standard for peer dependencies and does not introduce untrusted code execution.
-
PKGBUILD:34
npm install --prefix "$srcdir/peer-root" --omit=dev --ignore-scripts --legacy-peer-deps "${_peerdeps[@]}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
pkgname=opencode-quota
3
_npmname=@slkiser/opencode-quota
4
pkgver=4.4.0
5
pkgrel=1
6
pkgdesc="OpenCode plugin for quota & token usage tracking with zero context window pollution"
7
arch=('x86_64')
8
url="https://github.com/slkiser/opencode-quota"
9
license=('MIT')
10
depends=('gcc-libs' 'nodejs' 'opencode')
11
makedepends=('npm')
12
options=('!debug')
13
install=$pkgname.install
14
15
source=("$pkgname-$pkgver.tgz::https://registry.npmjs.org/$_npmname/-/$pkgname-$pkgver.tgz")
16
sha256sums=('49353efc713fffbdce830d73d2541a7612f7c21aed2fcf182c008db0e3e4c02a')
17
18
latestver() {
19
curl -fsSL "https://registry.npmjs.org/$_npmname/latest" | jq -r '.version'
20
}
21
22
package() {
23
cd "$srcdir/package"
24
25
npm install --omit=dev --omit=peer --ignore-scripts --legacy-peer-deps
26
27
mapfile -t _peerdeps < <(node -e '
28
const pkg = require("./package.json");
29
for (const [name, range] of Object.entries(pkg.peerDependencies ?? {}))
30
console.log(`${name}@${range}`);
31
')
32
if ((${#_peerdeps[@]})); then
33
rm -rf "$srcdir/peer-root"
34
npm install --prefix "$srcdir/peer-root" --omit=dev --ignore-scripts --legacy-peer-deps "${_peerdeps[@]}"
35
cp -a "$srcdir/peer-root/node_modules/." node_modules/
36
fi
37
38
# Remove build tools pulled in by npm resolution (not needed at runtime)
39
rm -rf node_modules/typescript node_modules/.bin
40
rm -f node_modules/@msgpackr-extract/msgpackr-extract-linux-x64/*.musl.node
41
rm -rf node_modules/@opentui/core/lib/tree-sitter/assets
42
rm -f node_modules/@opentui/core/lib/tree-sitter/update-assets.js node_modules/@opentui/core/lib/tree-sitter/update-assets.d.ts
43
rm -rf node_modules/jsesc/man node_modules/marked/man
44
45
install -d "$pkgdir/usr/lib/opencode/plugins/$pkgname"
46
cp -r . "$pkgdir/usr/lib/opencode/plugins/$pkgname/"
47
chmod 755 "$pkgdir/usr/lib/opencode/plugins/$pkgname/dist/bin/opencode-quota.js"
48
install -d "$pkgdir/usr/bin"
49
ln -s "/usr/lib/opencode/plugins/$pkgname/dist/bin/opencode-quota.js" "$pkgdir/usr/bin/opencode-quota"
50
51
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
52
}
53
Changes since previous scan
--- PKGBUILD @ 2026-07-30 00:17+++ PKGBUILD @ 2026-08-03 00:08@@ -1,7 +1,7 @@ # Maintainer: Yakov Till <yakov.till@gmail.com> pkgname=opencode-quota _npmname=@slkiser/opencode-quota-pkgver=4.3.1+pkgver=4.4.0 pkgrel=1 pkgdesc="OpenCode plugin for quota & token usage tracking with zero context window pollution" arch=('x86_64')@@ -13,7 +13,7 @@ install=$pkgname.install source=("$pkgname-$pkgver.tgz::https://registry.npmjs.org/$_npmname/-/$pkgname-$pkgver.tgz")-sha256sums=('0ee9b50aa6832a83bad561af2f53b3650f62c9a687bea8ed9e7f1a6e570c00d2')+sha256sums=('49353efc713fffbdce830d73d2541a7612f7c21aed2fcf182c008db0e3e4c02a') latestver() { curl -fsSL "https://registry.npmjs.org/$_npmname/latest" | jq -r '.version'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 1 |
| 2026-08-02 00:16:08 | LOW | 1 |
| 2026-08-01 00:11:18 | LOW | 1 |
| 2026-07-31 00:14:10 | LOW | 1 |
| 2026-07-30 23:17:02 | LOW | 1 |
| 2026-07-30 00:17:23 | LOW | 1 |
| 2026-07-29 00:25:53 | LOW | 1 |
| 2026-07-28 17:39:33 | LOW | 1 |
| 2026-07-27 11:35:00 | CLEAN | 1 |
| 2026-07-24 21:28:26 | CLEAN | 1 |
| 2026-07-24 15:27:57 | CLEAN | 1 |
| 2026-07-24 00:02:28 | LOW | 1 |
| 2026-07-23 03:22:31 | LOW | 1 |
| 2026-07-22 13:20:28 | CLEAN | 1 |
| 2026-07-22 00:29:32 | LOW | 1 |
| 2026-07-21 00:24:15 | LOW | 1 |
| 2026-07-20 00:19:49 | LOW | 1 |
| 2026-07-19 00:17:08 | LOW | 1 |
| 2026-07-18 00:14:48 | LOW | 1 |
| 2026-07-17 00:06:16 | LOW | 1 |