rootvim

maintainer realSUDO · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged Multiple serious issues: 1) Both sources have 'SKIP' checksums, meaning no integrity verification whatsoever — the zip from GitHub's main branch (not a tagged release) and an external 'install-noninteractive.sh' script are fetched without any hash validation. 2) The 'install-noninteractive.sh' script is a second source with SKIP checksum and unknown origin/content — it is executed directly with bash during packaging, representing an arbitrary code execution vector. 3) 'npm install -g typescript live-server' runs during the package() function, installing packages globally on the build host (not into $pkgdir), meaning it modifies the live system during packaging — this is both incorrect packaging practice and a supply-chain risk. 4) The wrapper script sets up a bundled Python environment from /usr/share/rootvim/.globalPython and prepends it to PATH, which could contain arbitrary executables. The combination of an unverified external shell script executed during build, no checksums on any source, and npm global installs modifying the host system during packaging constitutes a genuine high-severity supply-chain risk.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:28 npm install -g typescript live-server 2>/dev/null || true

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 85%): Multiple serious issues: 1) Both sources have 'SKIP' checksums, meaning no integrity verification whatsoever — the zip from GitHub's main branch (not a tagged release) and an external 'install-noninteractive.sh' script are fetched without any hash validation. 2) The 'install-noninteractive.sh' script is a second source with SKIP checksum and unknown origin/content — it is executed directly with bash during packaging, representing an arbitrary code execution vector. 3) 'npm install -g typescript live-server' runs during the package() function, installing packages globally on the build host (not into $pkgdir), meaning it modifies the live system during packaging — this is both incorrect packaging practice and a supply-chain risk. 4) The wrapper script sets up a bundled Python environment from /usr/share/rootvim/.globalPython and prepends it to PATH, which could contain arbitrary executables. The combination of an unverified external shell script executed during build, no checksums on any source, and npm global installs modifying the host system during packaging constitutes a genuine high-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: SUDO <justmultiplythinks@gmail.com>
    
      2pkgname=rootvim
    
      3pkgver=2.6.0
    
      4pkgrel=1
    
      5pkgdesc="Custom Neovim configuration by realSUDO with isolated profile"
    
      6arch=('any')
    
      7url="https://github.com/realSUDO/rootVim"
    
      8license=('MIT')
    
      9
    
      10# Required dependencies
    
      11depends=('neovim' 'python-pip' 'nodejs' 'npm' 'clang' 'xclip' 'wl-clipboard' 'tree-sitter' 'gcc' 'make' 'unzip' 'wget' 'curl' 'tar' 'gzip')
    
      12makedepends=('git')
    
      13optdepends=('stylua: Lua code formatting'
    
      14            'live-server: HTML development server (npm package)'
    
      15            'typescript: TypeScript compiler (npm package)')
    
      16
    
      17# Source: your main repo zip + non-interactive install script
    
      18source=("https://github.com/realSUDO/rootVim/archive/refs/heads/main.zip"
    
      19        "install-noninteractive.sh")
    
      20sha256sums=('SKIP'
    
      21            'SKIP')
    
      22
    
      23package() {
    
      24    # Install configuration files using the non-interactive script
    
      25    bash "$srcdir/install-noninteractive.sh" "$pkgdir"
    
      26
    
      27    # Install npm packages globally
    
      28    npm install -g typescript live-server 2>/dev/null || true
    
      29
    
      30    # Create wrapper script for isolated Neovim profile
    
      31    install -dm755 "$pkgdir/usr/bin"
    
      32    cat <<'EOF' > "$pkgdir/usr/bin/rootvim"
    
      33#!/bin/bash
    
      34NVIM_ROOTVIM_HOME="$HOME/.config/rootvim"
    
      35mkdir -p "$NVIM_ROOTVIM_HOME"
    
      36cp -r /usr/share/rootvim/* "$NVIM_ROOTVIM_HOME" 2>/dev/null
    
      37
    
      38# Activate bundled Python environment
    
      39GLOBAL_PY="/usr/share/rootvim/.globalPython"
    
      40export PATH="$GLOBAL_PY/bin:$PATH"
    
      41
    
      42exec nvim -u "$NVIM_ROOTVIM_HOME/init.lua" "$@"
    
      43EOF
    
      44    chmod +x "$pkgdir/usr/bin/rootvim"
    
      45	install -dm755 "$pkgdir/usr/share/rootvim"
    
      46	echo "rootvim version: 2.6.0" > "$pkgdir/usr/share/rootvim/VERSION"
    
      47	echo "Build date: $(date)" >> "$pkgdir/usr/share/rootvim/VERSION"
    
      48}
    
      49
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 00:17:23	HIGH	2
2026-07-29 00:25:53	HIGH	2
2026-07-28 00:07:28	HIGH	2
2026-07-27 00:24:32	HIGH	2
2026-07-26 00:07:32	HIGH	2
2026-07-25 00:13:44	HIGH	2
2026-07-24 00:02:28	HIGH	2
2026-07-23 00:14:47	HIGH	2
2026-07-22 00:29:32	HIGH	2
2026-07-21 00:24:15	HIGH	2
2026-07-20 00:19:49	HIGH	2
2026-07-19 00:17:08	HIGH	2
2026-07-18 00:14:48	HIGH	2
2026-07-17 00:06:16	HIGH	2
2026-07-16 00:05:41	HIGH	2
2026-07-15 00:09:25	HIGH	2