sigma-file-manager
MEDIUM
maintainer taotieren
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package uses 'npm install -g' with a dynamically generated package name from 'npm pack', which could result in installing an undeclared external package, posing a supply-chain risk if the source is tampered with.
Triggered rules
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:40
npm install -g --prefix "${pkgdir}/usr" $(npm pack)
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package uses 'npm install -g' with a dynamically generated package name from 'npm pack', which could result in installing an undeclared external package, posing a supply-chain risk if the source is tampered with.
-
PKGBUILD:40
npm install -g --prefix "${pkgdir}/usr" $(npm pack)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: taotieren <admin@taotieren.com>
2
3
pkgname=sigma-file-manager
4
_tagname=2.2.0
5
pkgver="${_tagname//-/_}"
6
pkgrel=1
7
pkgdesc="\"Sigma File Manager\" is a free, open-source, quickly evolving, modern file manager (explorer / finder) app for Windows and Linux."
8
arch=($CARCH)
9
url="https://github.com/aleksey-hoffman/sigma-file-manager"
10
license=('GPL-3.0-or-later')
11
provides=(${pkgname})
12
conflicts=(${pkgname} ${pkgname}-git)
13
replaces=()
14
depends=(
15
glibc
16
libgcc
17
nodejs
18
# AUR
19
zx
20
)
21
makedepends=(
22
git
23
electron-builder
24
npm
25
node-gyp
26
)
27
backup=()
28
options=('!strip' '!debug')
29
install=
30
source=("${pkgname}::git+${url}.git#tag=v${_tagname}")
31
sha256sums=('a37f3ee26e992c7dff745cce2eedc62d3a8fe3e63ff6bd42eca1acb8c719010d')
32
noextract=("${pkgname}-${_tagname}.tar.gz")
33
34
prepare() {
35
git -C "${srcdir}/${pkgname}" clean -dfx
36
}
37
38
package() {
39
cd "${srcdir}/${pkgname}"
40
npm install -g --prefix "${pkgdir}/usr" $(npm pack)
41
42
# Non-deterministic race in npm gives 777 permissions to random directories.
43
# See https://github.com/npm/cli/issues/1103 for details.
44
find "${pkgdir}/usr" -type d -exec chmod 755 {} +
45
46
# npm gives ownership of ALL FILES to build user
47
# https://bugs.archlinux.org/task/63396
48
chown -R root:root "${pkgdir}"
49
}
50
Changes since previous scan
--- PKGBUILD @ 2026-10-22 00:13+++ PKGBUILD @ 2026-11-01 00:21@@ -1,7 +1,7 @@ # Maintainer: taotieren <admin@taotieren.com> pkgname=sigma-file-manager-_tagname=2.2.1-rc.2+_tagname=2.2.0 pkgver="${_tagname//-/_}" pkgrel=1 pkgdesc="\"Sigma File Manager\" is a free, open-source, quickly evolving, modern file manager (explorer / finder) app for Windows and Linux."@@ -28,7 +28,7 @@ options=('!strip' '!debug') install= source=("${pkgname}::git+${url}.git#tag=v${_tagname}")-sha256sums=('fff2da0d36d4732a85dd2235563a5df593952a98e0904b0a28a1d042432a8653')+sha256sums=('a37f3ee26e992c7dff745cce2eedc62d3a8fe3e63ff6bd42eca1acb8c719010d') noextract=("${pkgname}-${_tagname}.tar.gz") prepare() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 11:34:35 | Medium | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 01:16:24 | Medium | 1 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |