rotorflight-blackbox

maintainer slackspace · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The build process installs Node.js packages globally via 'npm install yarn -g' without declaring yarn in the dependencies array, which could lead to unexpected behavior or supply-chain risks if the package source is compromised.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:40 npm install yarn -g

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 85%): The build process installs Node.js packages globally via 'npm install yarn -g' without declaring yarn in the dependencies array, which could lead to unexpected behavior or supply-chain risks if the package source is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jacob Morgan <arch_aur@slackspace.io>
    
      2pkgname=rotorflight-blackbox
    
      3pkgver=2.3.0
    
      4pkgrel=1
    
      5pkgdesc="Rotorflight Blackbox for Rotorflight FBL Controller"
    
      6arch=('x86_64')
    
      7url="https://github.com/rotorflight/rotorflight-blackbox"
    
      8license=('MIT')
    
      9options=('!debug' '!strip')
    
      10depends=('python' 'nodejs' 'npm' 'nvm')
    
      11makedepends=('yarn')
    
      12source=("$pkgname-$pkgver.tar.gz::https://github.com/rotorflight/rotorflight-blackbox/archive/refs/tags/release/${pkgver}.tar.gz"
    
      13        "$pkgname.desktop")
    
      14sha512sums=('78141cd2de1569cab20de3136ae3d813cf1ab3ba706bdf51b1d317bfe4ae8229b0a358f7e197f03136b42d50838f319d47bcc218a00d75a4430d74af686e8d26'
    
      15            'dc323d2e7bab4d0f65a9cd62d99e7bc696ac880bbe3ed824959c9d6b5142f9095195b3a234fb4676ef49dc5419f41218107e9f324e6351870a47aa19571b64f7')
    
      16
    
      17
    
      18_ensure_local_nvm() {
    
      19    # let's be sure we are starting clean
    
      20    which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      21    export NVM_DIR="${srcdir}/.nvm"
    
      22
    
      23    # The init script returns 3 if version specified
    
      24    # in ./.nvrc is not (yet) installed in $NVM_DIR
    
      25    # but nvm itself still gets loaded ok
    
      26    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      27}
    
      28
    
      29prepare() {
    
      30
    
      31  cd "${pkgname}-release-${pkgver}"
    
      32  _ensure_local_nvm
    
      33  nvm install 16
    
      34}
    
      35
    
      36build() {
    
      37  cd "${pkgname}-release-${pkgver}"
    
      38
    
      39  _ensure_local_nvm
    
      40  npm install  yarn -g
    
      41  yarn install 
    
      42  
    
      43  make version SEMVER="${pkgver}"
    
      44  yarn gulp apps --linux64 
    
      45
    
      46
    
      47
    
      48
    
      49}
    
      50
    
      51package() {
    
      52  cd "${pkgname}-release-${pkgver}"
    
      53
    
      54  install -d "$pkgdir/opt/$pkgname/"
    
      55  cp -r  apps/rotorflight-blackbox/linux64/* "${pkgdir}/opt/$pkgname/"
    
      56  chmod -R a=u,g-w,o-w "$pkgdir/opt/$pkgname/"
    
      57  install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      58
    
      59  install -d "$pkgdir/usr/bin/"
    
      60  ln -s /opt/$pkgname/$pkgname "$pkgdir/usr/bin/$pkgname"
    
      61
    
      62}
    
      63
    
      64
    
      65
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2