posthog-cli (MEDIUM)

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:22 pnpm install --frozen-lockfile --ignore-scripts --filter '@posthog/mcp...'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Byeonghoon Yoo <bhyoo@bhyoo.com>
    
      2pkgname=posthog-cli
    
      3pkgver=0.18.10
    
      4pkgrel=1
    
      5_commit=e519ba6304903b31e5e3d74c6d1a5fe9a96c745e
    
      6pkgdesc="The command line interface for PostHog"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/PostHog/posthog"
    
      9license=('MIT')
    
      10depends=('glibc' 'gcc-libs' 'zlib')
    
      11conflicts=('posthog-cli-bin')
    
      12makedepends=('cargo' 'nodejs-lts-krypton' 'pnpm')
    
      13optdepends=('nodejs: required for the posthog-cli api command')
    
      14options=('!lto')
    
      15source=("$pkgname-v$pkgver-$_commit.tar.gz::https://github.com/PostHog/posthog/archive/$_commit.tar.gz")
    
      16sha256sums=('1ab2ebb1a112451bab491f1a29fd177943ac90ea7004d9599c812e30f57cda6e')
    
      17
    
      18_srcdir="posthog-$_commit"
    
      19
    
      20prepare() {
    
      21    cd "$srcdir/$_srcdir"
    
      22    pnpm install --frozen-lockfile --ignore-scripts --filter '@posthog/mcp...'
    
      23    pnpm --dir services/mcp run build:cli:release
    
      24
    
      25    cd cli
    
      26    export RUSTUP_TOOLCHAIN=stable
    
      27    export CARGO_HOME="$srcdir/.cargo-home"
    
      28    cargo fetch --locked --target "$(rustc --print host-tuple)"
    
      29}
    
      30
    
      31build() {
    
      32    cd "$srcdir/$_srcdir/cli"
    
      33    export RUSTUP_TOOLCHAIN=stable
    
      34    export CARGO_HOME="$srcdir/.cargo-home"
    
      35    export CARGO_TARGET_DIR=target
    
      36    cargo build --frozen --release
    
      37}
    
      38
    
      39check() {
    
      40    cd "$srcdir/$_srcdir/cli"
    
      41    export RUSTUP_TOOLCHAIN=stable
    
      42    export CARGO_HOME="$srcdir/.cargo-home"
    
      43    export CARGO_TARGET_DIR=target
    
      44    cargo test --frozen
    
      45}
    
      46
    
      47package() {
    
      48    cd "$srcdir/$_srcdir/cli"
    
      49    install -Dm0755 -t "$pkgdir/usr/bin/" "target/release/$pkgname"
    
      50    install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname/" "$srcdir/$_srcdir/LICENSE"
    
      51}
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-10-08 00:28
+++ PKGBUILD @ 2026-10-08 12:08
@@ -1,7 +1,8 @@
 # Maintainer: Byeonghoon Yoo <bhyoo@bhyoo.com>
 pkgname=posthog-cli
-pkgver=0.18.9
+pkgver=0.18.10
 pkgrel=1
+_commit=e519ba6304903b31e5e3d74c6d1a5fe9a96c745e
 pkgdesc="The command line interface for PostHog"
 arch=('x86_64' 'aarch64')
 url="https://github.com/PostHog/posthog"
@@ -11,10 +12,10 @@
 makedepends=('cargo' 'nodejs-lts-krypton' 'pnpm')
 optdepends=('nodejs: required for the posthog-cli api command')
 options=('!lto')
-source=("$pkgname-v$pkgver.tar.gz::https://github.com/PostHog/posthog/archive/refs/tags/posthog-cli%2Fv$pkgver.tar.gz")
-sha256sums=('d81f6035a161e0ac6c2cf007a353c8e06f060c5416b942d64daeca024ac791d5')
+source=("$pkgname-v$pkgver-$_commit.tar.gz::https://github.com/PostHog/posthog/archive/$_commit.tar.gz")
+sha256sums=('1ab2ebb1a112451bab491f1a29fd177943ac90ea7004d9599c812e30f57cda6e')
 
-_srcdir="posthog-posthog-cli-v$pkgver"
+_srcdir="posthog-$_commit"
 
 prepare() {
     cd "$srcdir/$_srcdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-08 12:08:47	Medium	1
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 07:23:03	Medium	1
2026-09-29 00:07:46	Low	2
2026-09-28 19:21:21	Medium	1
2026-09-28 13:20:45	Medium	1
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 15:43:55	Medium	1
2026-09-24 13:43:45	Medium	1