pkg

maintainer arthuro555 · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs the 'pkg' npm package directly from the npm registry at build time using 'npm install -g pkg@5.3.2' rather than from a declared, checksummed source archive. There is no source array and no integrity verification (no checksums). This means the actual code executed and installed is fetched live from npmjs.com during packaging, with no reproducibility guarantee and no tamper detection. While npmjs.com is an official ecosystem registry (not a personal/unofficial host), the AUR packaging pattern is still problematic: the package content is not pinned to a specific tarball hash, so a compromised or yanked-and-replaced npm package version could silently deliver malicious code. The commented-out alternative approach (using a local tarball from srcdir) would have been safer. This is a genuine supply-chain concern — executed Node.js code from an unverified, unchecksummed remote fetch — warranting a medium rating.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:21 npm install -g pkg@${pkgver} --user root --prefix "${pkgdir}/usr"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD installs the 'pkg' npm package directly from the npm registry at build time using 'npm install -g pkg@5.3.2' rather than from a declared, checksummed source archive. There is no source array and no integrity verification (no checksums). This means the actual code executed and installed is fetched live from npmjs.com during packaging, with no reproducibility guarantee and no tamper detection. While npmjs.com is an official ecosystem registry (not a personal/unofficial host), the AUR packaging pattern is still problematic: the package content is not pinned to a specific tarball hash, so a compromised or yanked-and-replaced npm package version could silently deliver malicious code. The commented-out alternative approach (using a local tarball from srcdir) would have been safer. This is a genuine supply-chain concern — executed Node.js code from an unverified, unchecksummed remote fetch — warranting a medium rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jonas Heinrich <onny@project-insanity.org>
    
      2# Contributor: Jonas Heinrich <onny@project-insanity.org>
    
      3
    
      4pkgname=pkg
    
      5pkgver=5.3.2
    
      6pkgrel=1
    
      7pkgdesc="Package your Node.js project into an executable"
    
      8arch=('x86_64')
    
      9url="https://github.com/zeit/pkg"
    
      10license=('MIT')
    
      11depends=('nodejs')
    
      12makedepends=('npm')
    
      13
    
      14#build() {
    
      15#  cd "${srcdir}/${pkgname}-${pkgver}"
    
      16#  npm install --prefix "${srcdir}/test" -g
    
      17#}
    
      18
    
      19package() {
    
      20    #npm install -g --user root --prefix "${pkgdir}/usr" "${srcdir}/${pkgname}-${pkgver}.tar.gz"
    
      21    npm install -g pkg@${pkgver} --user root --prefix "${pkgdir}/usr"
    
      22
    
      23    # Non-deterministic race in npm gives 777 permissions to random directories.
    
      24    # See https://github.com/npm/npm/issues/9359 for details.
    
      25    find "${pkgdir}/usr" -type d -exec chmod 755 {} +
    
      26
    
      27    # npm gives ownership of ALL FILES to build user
    
      28    # https://bugs.archlinux.org/task/63396
    
      29    chown -R root:root "${pkgdir}"
    
      30}
    
      31
    
      32#package() {
    
      33#  cd "${srcdir}/${pkgname}"
    
      34#  install -d "${pkgdir}/usr/bin"
    
      35#  cp -r "${srcdir}/${pkgname}" "${pkgdir}/usr/lib/"
    
      36#  echo -e '#!/usr/bin/bash\nnode /usr/lib/smloadr/SMLoadr.js "$@"' > "${pkgdir}/usr/bin/smloadr"
    
      37#  chmod +x "${pkgdir}/usr/bin/smloadr"
    
      38#}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2