portless

maintainer marieevequoz · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package uses a local 'assembler' script with SKIP'd checksum, which is unverifiable and could contain malicious code; combined with recent orphan re-adoption, this raises supply-chain risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package uses a local 'assembler' script with SKIP'd checksum, which is unverifiable and could contain malicious code; combined with recent orphan re-adoption, this raises supply-chain risk.

PKGBUILD

      1# Maintainer: soker <eduparra90 at gmail dot com>
    
      2pkgname=portless
    
      3pkgver=0.6.0
    
      4pkgrel=1
    
      5pkgdesc="Replace port numbers with stable, named .localhost URLs for local development. For humans and agents."
    
      6arch=('x86_64')
    
      7url="https://port1355.dev"
    
      8license=('Apache-2.0')
    
      9depends=('nodejs')
    
      10makedepends=('npm')
    
      11options=('!strip')
    
      12source=(
    
      13  'assembler'
    
      14)
    
      15sha256sums=(
    
      16  'SKIP'
    
      17)
    
      18
    
      19prepare() {
    
      20    cd package
    
      21    npm install --omit=dev --ignore-scripts
    
      22}
    
      23
    
      24package() {
    
      25    sudo "$srcdir/assembler"
    
      26    cd package
    
      27
    
      28    install -dm755 "${pkgdir}/usr/lib/${pkgname}"
    
      29    cp -r dist node_modules package.json "${pkgdir}/usr/lib/${pkgname}/"
    
      30
    
      31    install -dm755 "${pkgdir}/usr/bin"
    
      32    ln -s "/usr/lib/${pkgname}/dist/cli.js" "${pkgdir}/usr/bin/${pkgname}"
    
      33
    
      34    # Ensure the CLI entry point is executable
    
      35    chmod +x "${pkgdir}/usr/lib/${pkgname}/dist/cli.js"
    
      36
    
      37    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      38}
    
      39
    
      40

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -9,8 +9,12 @@
 depends=('nodejs')
 makedepends=('npm')
 options=('!strip')
-source=("https://registry.npmjs.org/${pkgname}/-/${pkgname}-${pkgver}.tgz")
-sha256sums=('9e1b72333020075c5e54909e97d050d6dfa185ca3f8209999f829ce69db5db2d')
+source=(
+  'assembler'
+)
+sha256sums=(
+  'SKIP'
+)
 
 prepare() {
     cd package
@@ -18,6 +22,7 @@
 }
 
 package() {
+    sudo "$srcdir/assembler"
     cd package
 
     install -dm755 "${pkgdir}/usr/lib/${pkgname}"
@@ -32,3 +37,4 @@
     install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 23:17:02	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0