pgconsole

LOW

maintainer agony4001 0 votes scanned 2026-10-24 17:41:05.329835

View on AUR

Why flagged

The package builds from an official npm registry source, installs only declared dependencies via npm using locked versions from the project's package.json, and does not execute untrusted remote code; the flagged variable-named package install refers to the project's own dependencies, posing minimal risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): The package builds from an official npm registry source, installs only declared dependencies via npm using locked versions from the project's package.json, and does not execute untrusted remote code; the flagged variable-named package install refers to the project's own dependencies, posing minimal risk.

PKGBUILD:26 npm install --cache "${srcdir}/npm-cache" --omit=dev --ignore-scripts --no-package-lock --no-audit --no-fund "${deps[@]}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: agony <27015 at riseup dot net>
    
      2
    
      3pkgname=pgconsole
    
      4pkgver=1.3.0
    
      5pkgrel=1
    
      6pkgdesc="Web-based PostgreSQL editor with access control and audit logging"
    
      7arch=('any')
    
      8url="https://github.com/pgplex/pgconsole"
    
      9license=('Apache-2.0')
    
      10depends=('nodejs')
    
      11makedepends=('jq' 'npm')
    
      12source=("https://registry.npmjs.org/@pgplex/${pkgname}/-/${pkgname}-${pkgver}.tgz")
    
      13sha256sums=('721cfb0afddbacd015d01115849f85aa208fd00ee75c7979ac502e43ee873909')
    
      14
    
      15# Modules the server bundle leaves external, as in upstream scripts/build-server.mjs
    
      16_externals=('pg' 'postgres' 'express' '@libpg-query/parser' '@electric-sql/pglite' '@electric-sql/pglite-socket')
    
      17
    
      18build() {
    
      19  local name deps=()
    
      20  for name in "${_externals[@]}"; do
    
      21    deps+=("${name}@$(jq -r --arg name "${name}" '.dependencies[$name]' package/package.json)")
    
      22  done
    
      23  mkdir -p runtime
    
      24  cd runtime
    
      25  printf '{"private": true}\n' > package.json
    
      26  npm install --cache "${srcdir}/npm-cache" --omit=dev --ignore-scripts --no-package-lock --no-audit --no-fund "${deps[@]}"
    
      27}
    
      28
    
      29package() {
    
      30  local dest="${pkgdir}/usr/lib/${pkgname}"
    
      31  install -Dm755 package/dist/server.mjs -t "${dest}/dist"
    
      32  cp -r package/dist/client "${dest}/dist/"
    
      33  install -Dm644 package/package.json -t "${dest}"
    
      34  cp -r runtime/node_modules "${dest}/"
    
      35  install -d "${pkgdir}/usr/bin"
    
      36  ln -s "/usr/lib/${pkgname}/dist/server.mjs" "${pkgdir}/usr/bin/${pkgname}"
    
      37  install -Dm644 package/LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      38  install -Dm644 package/README.md -t "${pkgdir}/usr/share/doc/${pkgname}"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 17:41:05	Low	2