playwright-mcp

HIGH

maintainer lapsus 3 votes scanned 2026-09-19 01:29:45.802631

View on AUR

Why flagged

curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.

Triggered rules

High Remote download executed by a shell curl_pipe_shell

curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.

PKGBUILD:21 curl -fsSL "https://registry.npmjs.org/${_npmname}/latest" |

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2pkgname=playwright-mcp
    
      3pkgver=0.0.81
    
      4pkgrel=1
    
      5pkgdesc="MCP server that provides browser automation capabilities using Playwright"
    
      6arch=('any')
    
      7url="https://github.com/microsoft/playwright-mcp"
    
      8license=('Apache-2.0')
    
      9depends=('nodejs>=18')
    
      10makedepends=('npm')
    
      11optdepends=(
    
      12    'chromium: use system Chromium instead of Playwright-managed browsers'
    
      13    'firefox: use system Firefox instead of Playwright-managed browsers'
    
      14)
    
      15_npmname="@playwright/mcp"
    
      16source=("$pkgname-$pkgver.tgz::https://registry.npmjs.org/${_npmname}/-/mcp-${pkgver}.tgz")
    
      17sha256sums=('4289f7d5fe256b69db0e49050148b175af80fcf8caba814ec6b7b64f5f64161b')
    
      18noextract=("$pkgname-$pkgver.tgz")
    
      19
    
      20latestver() {
    
      21    curl -fsSL "https://registry.npmjs.org/${_npmname}/latest" |
    
      22        python3 -c "import sys,json; print(json.load(sys.stdin)['version'])"
    
      23}
    
      24
    
      25package() {
    
      26    npm install -g --prefix "$pkgdir/usr" --cache "$srcdir/npm-cache" \
    
      27        --omit=dev --ignore-scripts "$srcdir/$pkgname-$pkgver.tgz"
    
      28
    
      29    # Remove non-Linux platform scripts
    
      30    find "$pkgdir" -type f \( -name "*.ps1" -o -name "*_mac.*" -o -name "*_wsl.*" \) -delete
    
      31
    
      32    # Fix npm reference paths
    
      33    find "$pkgdir" -type f -name package.json -print0 | xargs -0 sed -i "/_where/d"
    
      34    find "$pkgdir" -name package.json -exec sed -i "s|$srcdir||g;s|$pkgdir||g" {} +
    
      35
    
      36    chown -R root:root "$pkgdir"
    
      37}
    
      38

Changes since previous scan

--- PKGBUILD @ 2026-09-01 11:49
+++ PKGBUILD @ 2026-09-19 01:29
@@ -1,6 +1,6 @@
 # Maintainer: Yakov Till <yakov.till@gmail.com>
 pkgname=playwright-mcp
-pkgver=0.0.80
+pkgver=0.0.81
 pkgrel=1
 pkgdesc="MCP server that provides browser automation capabilities using Playwright"
 arch=('any')
@@ -14,7 +14,7 @@
 )
 _npmname="@playwright/mcp"
 source=("$pkgname-$pkgver.tgz::https://registry.npmjs.org/${_npmname}/-/mcp-${pkgver}.tgz")
-sha256sums=('b81eda3f0a7cc70a9caf7db520cdad58c48a1dd334b4e3fcf096c0512c98af0d')
+sha256sums=('4289f7d5fe256b69db0e49050148b175af80fcf8caba814ec6b7b64f5f64161b')
 noextract=("$pkgname-$pkgver.tgz")
 
 latestver() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-19 01:29:45	High	1
2026-09-14 23:20:30	Clean	2
2026-09-14 23:18:17	High	1
2026-09-01 11:49:26	Clean	2
2026-09-01 11:47:58	High	1
2026-08-11 19:31:16	Clean	2
2026-08-11 19:21:46	High	1
2026-07-09 21:35:11	Clean	2
2026-07-09 21:32:33	High	1
2026-06-30 02:36:37	Clean	2
2026-06-19 19:07:35	Clean	3
2026-06-18 18:04:49	Clean	3
2026-06-18 16:11:54	High	2