ride-the-lightning

maintainer bitcoinlizard · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs the main RTL application from a signed upstream tarball (with PGP verification via validpgpkeys), which is good. However, line 43 runs a second `npm install -g ... request --save` that fetches the 'request' npm package directly from the npm registry at build time without any checksum or version pin. This is a real supply-chain concern: the 'request' package version is unspecified and unverified, meaning a compromised or malicious version on npm could be silently installed and executed as part of the application. The 'request' package is deprecated and its npm slot could theoretically be squatted or tampered with. This is a genuine medium-severity supply-chain risk — not a false positive — because it involves executed JavaScript code pulled from an external, unverified source with no integrity check.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:43 npm install -g --only=prod --legacy-peer-deps --cache "${srcdir}/npm-cache" --prefix "${pkgdir}/usr" request --save

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs the main RTL application from a signed upstream tarball (with PGP verification via validpgpkeys), which is good. However, line 43 runs a second `npm install -g ... request --save` that fetches the 'request' npm package directly from the npm registry at build time without any checksum or version pin. This is a real supply-chain concern: the 'request' package version is unspecified and unverified, meaning a compromised or malicious version on npm could be silently installed and executed as part of the application. The 'request' package is deprecated and its npm slot could theoretically be squatted or tampered with. This is a genuine medium-severity supply-chain risk — not a false positive — because it involves executed JavaScript code pulled from an external, unverified source with no integrity check.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bitcoinlizard <bitcoinlizard at fastmail dot com>
    
      2
    
      3pkgname=ride-the-lightning
    
      4pkgver=0.15.8
    
      5pkgrel=1
    
      6pkgdesc="RTL is a full function, device agnostic, web user interface to help manage lightning node operations."
    
      7arch=(any)
    
      8url="https://www.ridethelightning.info"
    
      9license=("MIT")
    
      10depends=("nodejs>=12")
    
      11makedepends=("npm" "jq" "moreutils")
    
      12optdepends=("lnd" "core-lightning")
    
      13backup=("usr/lib/systemd/system/RTL.service")
    
      14install=$pkgname.install
    
      15source=("https://github.com/Ride-The-Lightning/RTL/archive/refs/tags/v${pkgver}.tar.gz"
    
      16	"https://github.com/Ride-The-Lightning/RTL/releases/download/v${pkgver}/v${pkgver}.tar.gz.asc"
    
      17	"RTL.service"
    
      18	"ride-the-lightning.install"
    
      19	"RTL.sysusers"
    
      20	"RTL.tmpfiles")
    
      21
    
      22#noextract=("v${pkgver}.tar.gz")
    
      23sha256sums=('f17746c8e47107676465107f625ef387e42eaa8e0bfd8d15982e81adbaff86a5'
    
      24            'SKIP'
    
      25            '8018bd40de57b45b282943c27887d3eba35e3b0bae26a5a4f6b833b3aff66a7e'
    
      26            '0898aaf7835abde7680b17b4dc9969ae4d1d3e173328e49c57617bd3e3fa0b95'
    
      27            '96c2cb03de12854d481e9e81f55ecc6c757c7680f3337769f807fe0c12eef60e'
    
      28            'b3a51675fceae1cfcec447bca09fe89292512670bd3dcda605defcc5d96b66a9')
    
      29
    
      30validpgpkeys=('3E9BD4436C288039CA827A9200C9E2BC2E45666F') # suheb
    
      31
    
      32prepare() {
    
      33  # Unpacking license file
    
      34  tar -zxvf "${srcdir}/v${pkgver}.tar.gz" --directory "${srcdir}" "RTL-${pkgver}/LICENSE"
    
      35}
    
      36
    
      37package() {
    
      38  
    
      39  # Installing RTL
    
      40  npm install -g --only=prod --legacy-peer-deps --cache "${srcdir}/npm-cache" --prefix "${pkgdir}/usr" "${srcdir}/v${pkgver}.tar.gz"
    
      41  
    
      42  # Installing request dependency
    
      43  npm install -g --only=prod --legacy-peer-deps --cache "${srcdir}/npm-cache" --prefix "${pkgdir}/usr" request --save
    
      44
    
      45  # Installing license file
    
      46  install -Dm644 "${srcdir}/RTL-${pkgver}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      47
    
      48  # Fixing permissions
    
      49  find "${pkgdir}/usr" -type d -exec chmod 755 {} +
    
      50
    
      51  # npm gives ownership of ALL FILES to build user
    
      52  # https://bugs.archlinux.org/task/63396
    
      53  chown -R root:root "${pkgdir}"
    
      54
    
      55  find "$pkgdir" -type f -name __ngcc_entry_points__.json -execdir sh -c "jq '. |= with_entries(select(.key | test(\"_.+\") | not))' {} | sponge {}" \;
    
      56
    
      57  # Removing references to pkgdir
    
      58  find "${pkgdir}" -type f -name "package.json" -print0 | xargs -0 sed -i "/_where/d"
    
      59
    
      60  # Removing references to srcdir
    
      61  local tmppackage="$(mktemp)"
    
      62  local pkgjson="${pkgdir}/usr/lib/node_modules/rtl/package.json"
    
      63  jq '.|=with_entries(select(.key|test("_.+")|not))' "${pkgjson}" > "${tmppackage}"
    
      64  mv "${tmppackage}" "${pkgjson}"
    
      65  chmod 644 "${pkgjson}"
    
      66
    
      67  # install systemd file
    
      68  install -Dm644 "$srcdir/RTL.service" "$pkgdir/usr/lib/systemd/system/RTL.service"
    
      69  install -Dm644 "$srcdir/RTL.sysusers" "$pkgdir/usr/lib/sysusers.d/RTL.conf"
    
      70  install -Dm644 "$srcdir/RTL.tmpfiles" "$pkgdir/usr/lib/tempfiles.d/RTL.conf"
    
      71  install -Dm644 "$pkgdir/usr/lib/node_modules/rtl/Sample-RTL-Config.json" "$pkgdir/etc/RTL/Sample-RTL-Config.json"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2