ris-mcp-ts
LOW
maintainer lapsus
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npx command runs tsc (TypeScript compiler) locally as part of building the project's own source; it does not execute arbitrary remote code or install packages from untrusted sources.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs tsc (TypeScript compiler) locally as part of building the project's own source; it does not execute arbitrary remote code or install packages from untrusted sources.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:22
npx tsc
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
pkgname=ris-mcp-ts
3
pkgver=1.8.2
4
pkgrel=1
5
pkgdesc='MCP server for the Austrian Legal Information System (RIS)'
6
arch=('any')
7
url='https://github.com/Honeyfield-Org/ris-mcp-ts'
8
license=('MIT')
9
depends=('nodejs')
10
makedepends=('npm')
11
source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
12
sha256sums=('4ba114d4d17387dd37e1a90f3a64f94aa29fe344fab38ecefa30c41853f62fb4')
13
14
prepare() {
15
cd "${pkgname}-${pkgver}"
16
npm install --ignore-scripts
17
}
18
19
build() {
20
cd "${pkgname}-${pkgver}"
21
node scripts/gen-ui.mjs
22
npx tsc
23
}
24
25
package() {
26
cd "${pkgname}-${pkgver}"
27
npm prune --omit=dev --ignore-scripts
28
find node_modules -type d -empty -delete
29
30
local _destdir="${pkgdir}/usr/lib/${pkgname}"
31
install -d "${_destdir}"
32
cp -r dist node_modules package.json "${_destdir}/"
33
34
install -d "${pkgdir}/usr/bin"
35
ln -s "/usr/lib/${pkgname}/dist/index.js" "${pkgdir}/usr/bin/${pkgname}"
36
chmod 755 "${_destdir}/dist/index.js"
37
38
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
39
}
40
41
latestver() {
42
gh api --paginate repos/Honeyfield-Org/ris-mcp-ts/tags --jq '.[].name' |
43
sed -nE 's/^v([0-9]+(\.[0-9]+)*)$/\1/p' | sort -V | tail -1
44
}
45
Changes since previous scan
--- PKGBUILD @ 2026-09-08 00:18+++ PKGBUILD @ 2026-09-17 00:27@@ -1,6 +1,6 @@ # Maintainer: Yakov Till <yakov.till@gmail.com> pkgname=ris-mcp-ts-pkgver=1.8.0+pkgver=1.8.2 pkgrel=1 pkgdesc='MCP server for the Austrian Legal Information System (RIS)' arch=('any')@@ -9,7 +9,7 @@ depends=('nodejs') makedepends=('npm') source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")-sha256sums=('cc2e4af9a45fe5a34f1ed574fdebf788b21bfaeed80ba22bdd2ae58d95b14800')+sha256sums=('4ba114d4d17387dd37e1a90f3a64f94aa29fe344fab38ecefa30c41853f62fb4') prepare() { cd "${pkgname}-${pkgver}"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 17:18:20 | Medium | 1 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 01:59:11 | Medium | 1 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |