posthog-cli (MEDIUM)

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:20 pnpm install --frozen-lockfile --ignore-scripts --filter '@posthog/mcp...'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Byeonghoon Yoo <bhyoo@bhyoo.com>
    
      2pkgname=posthog-cli
    
      3pkgver=0.14.1
    
      4pkgrel=1
    
      5pkgdesc="The command line interface for PostHog"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/PostHog/posthog"
    
      8license=('MIT')
    
      9depends=('glibc' 'gcc-libs' 'zlib')
    
      10makedepends=('cargo' 'nodejs>=24' 'pnpm')
    
      11optdepends=('nodejs: required for the posthog-cli api command')
    
      12options=('!lto')
    
      13source=("$pkgname-v$pkgver.tar.gz::https://github.com/PostHog/posthog/archive/refs/tags/posthog-cli%2Fv$pkgver.tar.gz")
    
      14sha256sums=('82384b08f58566e4cff566b9dfbb2f7357d252b61e18c36c6eb7157278f293c8')
    
      15
    
      16_srcdir="posthog-posthog-cli-v$pkgver"
    
      17
    
      18prepare() {
    
      19    cd "$srcdir/$_srcdir"
    
      20    pnpm install --frozen-lockfile --ignore-scripts --filter '@posthog/mcp...'
    
      21    pnpm --dir services/mcp run build:cli:release
    
      22
    
      23    cd cli
    
      24    export RUSTUP_TOOLCHAIN=stable
    
      25    export CARGO_HOME="$srcdir/.cargo-home"
    
      26    cargo fetch --locked --target "$(rustc --print host-tuple)"
    
      27}
    
      28
    
      29build() {
    
      30    cd "$srcdir/$_srcdir/cli"
    
      31    export RUSTUP_TOOLCHAIN=stable
    
      32    export CARGO_HOME="$srcdir/.cargo-home"
    
      33    export CARGO_TARGET_DIR=target
    
      34    cargo build --frozen --release
    
      35}
    
      36
    
      37check() {
    
      38    cd "$srcdir/$_srcdir/cli"
    
      39    export RUSTUP_TOOLCHAIN=stable
    
      40    export CARGO_HOME="$srcdir/.cargo-home"
    
      41    export CARGO_TARGET_DIR=target
    
      42    cargo test --frozen
    
      43}
    
      44
    
      45package() {
    
      46    cd "$srcdir/$_srcdir/cli"
    
      47    install -Dm0755 -t "$pkgdir/usr/bin/" "target/release/$pkgname"
    
      48    install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname/" "$srcdir/$_srcdir/LICENSE"
    
      49}
    
      50

Changes since previous scan

--- PKGBUILD @ 2026-08-21 21:15
+++ PKGBUILD @ 2026-08-24 01:21
@@ -1,21 +1,26 @@
 # Maintainer: Byeonghoon Yoo <bhyoo@bhyoo.com>
 pkgname=posthog-cli
-pkgver=0.13.3
+pkgver=0.14.1
 pkgrel=1
 pkgdesc="The command line interface for PostHog"
 arch=('x86_64' 'aarch64')
 url="https://github.com/PostHog/posthog"
 license=('MIT')
 depends=('glibc' 'gcc-libs' 'zlib')
-makedepends=('cargo')
+makedepends=('cargo' 'nodejs>=24' 'pnpm')
+optdepends=('nodejs: required for the posthog-cli api command')
 options=('!lto')
 source=("$pkgname-v$pkgver.tar.gz::https://github.com/PostHog/posthog/archive/refs/tags/posthog-cli%2Fv$pkgver.tar.gz")
-sha256sums=('89f8eea01164856c845a9721ee6457b30aef2cccabfb8133ac503c940f0e2dc5')
+sha256sums=('82384b08f58566e4cff566b9dfbb2f7357d252b61e18c36c6eb7157278f293c8')
 
 _srcdir="posthog-posthog-cli-v$pkgver"
 
 prepare() {
-    cd "$srcdir/$_srcdir/cli"
+    cd "$srcdir/$_srcdir"
+    pnpm install --frozen-lockfile --ignore-scripts --filter '@posthog/mcp...'
+    pnpm --dir services/mcp run build:cli:release
+
+    cd cli
     export RUSTUP_TOOLCHAIN=stable
     export CARGO_HOME="$srcdir/.cargo-home"
     cargo fetch --locked --target "$(rustc --print host-tuple)"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-24 01:21:42	Medium	1
2026-08-21 21:15:20	Clean	0
2026-08-21 03:13:51	Clean	0
2026-08-19 03:41:13	Clean	0
2026-08-17 17:37:06	Clean	0
2026-08-14 11:29:14	Clean	0
2026-08-13 13:26:16	Clean	0
2026-08-13 05:25:33	Clean	0
2026-08-12 05:22:53	Clean	0
2026-07-31 11:17:50	Clean	0
2026-07-30 13:14:23	Clean	0
2026-07-28 07:37:32	Clean	0
2026-07-26 05:31:42	Clean	0
2026-07-17 01:53:03	Clean	0
2026-07-16 01:50:03	Clean	0
2026-07-14 01:43:48	Clean	0
2026-07-07 09:24:03	Clean	0
2026-07-01 02:40:12	Clean	0
2026-06-26 18:26:37	Clean	0
2026-06-25 00:21:16	Clean	0