ris-mcp-ts

maintainer lapsus · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx command runs 'tsc' (TypeScript compiler) locally as part of the build process on the project's own source code, which is downloaded from the project's official GitHub repository; this is a standard and safe practice in Node.js packaging.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs 'tsc' (TypeScript compiler) locally as part of the build process on the project's own source code, which is downloaded from the project's official GitHub repository; this is a standard and safe practice in Node.js packaging.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:21 npx tsc

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2pkgname=ris-mcp-ts
    
      3pkgver=1.3.0
    
      4pkgrel=1
    
      5pkgdesc='MCP server for the Austrian Legal Information System (RIS)'
    
      6arch=('any')
    
      7url='https://github.com/Honeyfield-Org/ris-mcp-ts'
    
      8license=('MIT')
    
      9depends=('nodejs')
    
      10makedepends=('npm')
    
      11source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
    
      12sha256sums=('e5bdfe472cf0479f11724f1241e956710c4694cbf9af9a913d9c4c40725d7c1d')
    
      13
    
      14prepare() {
    
      15    cd "${pkgname}-${pkgver}"
    
      16    npm install --ignore-scripts
    
      17}
    
      18
    
      19build() {
    
      20    cd "${pkgname}-${pkgver}"
    
      21    npx tsc
    
      22}
    
      23
    
      24package() {
    
      25    cd "${pkgname}-${pkgver}"
    
      26    npm prune --omit=dev --ignore-scripts
    
      27    find node_modules -type d -empty -delete
    
      28
    
      29    local _destdir="${pkgdir}/usr/lib/${pkgname}"
    
      30    install -d "${_destdir}"
    
      31    cp -r dist node_modules package.json "${_destdir}/"
    
      32
    
      33    install -d "${pkgdir}/usr/bin"
    
      34    ln -s "/usr/lib/${pkgname}/dist/index.js" "${pkgdir}/usr/bin/${pkgname}"
    
      35    chmod 755 "${_destdir}/dist/index.js"
    
      36
    
      37    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      38}
    
      39
    
      40latestver() {
    
      41    gh api --paginate repos/Honeyfield-Org/ris-mcp-ts/tags --jq '.[].name' |
    
      42        sed -nE 's/^v([0-9]+(\.[0-9]+)*)$/\1/p' | sort -V | tail -1
    
      43}
    
      44

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Yakov Till <yakov.till@gmail.com>
 pkgname=ris-mcp-ts
-pkgver=1.2.4
+pkgver=1.3.0
 pkgrel=1
 pkgdesc='MCP server for the Austrian Legal Information System (RIS)'
 arch=('any')
@@ -9,7 +9,7 @@
 depends=('nodejs')
 makedepends=('npm')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('7bd683ab754797e3740aefa626418171bdf298b6f3ac138b8648852b6ac3ee01')
+sha256sums=('e5bdfe472cf0479f11724f1241e956710c4694cbf9af9a913d9c4c40725d7c1d')
 
 prepare() {
     cd "${pkgname}-${pkgver}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 13:18:10	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2