rotorflight-blackbox

MEDIUM

maintainer slackspace 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The build process installs Node.js packages globally via 'npm install yarn -g' without declaring yarn in the dependencies array, which could lead to unexpected behavior or supply-chain risks if the package source is compromised.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:40 npm install yarn -g

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 85%): The build process installs Node.js packages globally via 'npm install yarn -g' without declaring yarn in the dependencies array, which could lead to unexpected behavior or supply-chain risks if the package source is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jacob Morgan <arch_aur@slackspace.io>
    
      2pkgname=rotorflight-blackbox
    
      3pkgver=2.3.0
    
      4pkgrel=1
    
      5pkgdesc="Rotorflight Blackbox for Rotorflight FBL Controller"
    
      6arch=('x86_64')
    
      7url="https://github.com/rotorflight/rotorflight-blackbox"
    
      8license=('MIT')
    
      9options=('!debug' '!strip')
    
      10depends=('python' 'nodejs' 'npm' 'nvm')
    
      11makedepends=('yarn')
    
      12source=("$pkgname-$pkgver.tar.gz::https://github.com/rotorflight/rotorflight-blackbox/archive/refs/tags/release/${pkgver}.tar.gz"
    
      13        "$pkgname.desktop")
    
      14sha512sums=('78141cd2de1569cab20de3136ae3d813cf1ab3ba706bdf51b1d317bfe4ae8229b0a358f7e197f03136b42d50838f319d47bcc218a00d75a4430d74af686e8d26'
    
      15            'dc323d2e7bab4d0f65a9cd62d99e7bc696ac880bbe3ed824959c9d6b5142f9095195b3a234fb4676ef49dc5419f41218107e9f324e6351870a47aa19571b64f7')
    
      16
    
      17
    
      18_ensure_local_nvm() {
    
      19    # let's be sure we are starting clean
    
      20    which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      21    export NVM_DIR="${srcdir}/.nvm"
    
      22
    
      23    # The init script returns 3 if version specified
    
      24    # in ./.nvrc is not (yet) installed in $NVM_DIR
    
      25    # but nvm itself still gets loaded ok
    
      26    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      27}
    
      28
    
      29prepare() {
    
      30
    
      31  cd "${pkgname}-release-${pkgver}"
    
      32  _ensure_local_nvm
    
      33  nvm install 16
    
      34}
    
      35
    
      36build() {
    
      37  cd "${pkgname}-release-${pkgver}"
    
      38
    
      39  _ensure_local_nvm
    
      40  npm install  yarn -g
    
      41  yarn install 
    
      42  
    
      43  make version SEMVER="${pkgver}"
    
      44  yarn gulp apps --linux64 
    
      45
    
      46
    
      47
    
      48
    
      49}
    
      50
    
      51package() {
    
      52  cd "${pkgname}-release-${pkgver}"
    
      53
    
      54  install -d "$pkgdir/opt/$pkgname/"
    
      55  cp -r  apps/rotorflight-blackbox/linux64/* "${pkgdir}/opt/$pkgname/"
    
      56  chmod -R a=u,g-w,o-w "$pkgdir/opt/$pkgname/"
    
      57  install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      58
    
      59  install -d "$pkgdir/usr/bin/"
    
      60  ln -s /opt/$pkgname/$pkgname "$pkgdir/usr/bin/$pkgname"
    
      61
    
      62}
    
      63
    
      64
    
      65
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2