spacebar-client-git

MEDIUM

maintainer skarbricat 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD runs 'npm install -g serve' during the package() function, which installs the 'serve' npm package globally into the build environment (and potentially the system) at package-build time rather than declaring it as a proper dependency. This is a real supply-chain concern: the 'serve' package is fetched from the npm registry at build time without any version pinning or integrity verification, meaning a compromised or malicious version of 'serve' could execute arbitrary code during packaging. Additionally, 'npm install -g' during package() is architecturally wrong — it installs into the live system rather than $pkgdir, so the package won't cleanly track or uninstall this dependency. The 'serve' package itself is a well-known npm package (by Vercel), so the risk is moderate rather than high, but the pattern of pulling an unpinned external npm package and installing it globally during packaging is a genuine supply-chain concern that warrants medium severity. The second git source from a personal maintainer repo (0xGingi/spacebarchat-client-aur) is used only for a systemd service file, which is lower risk but still worth noting as an unofficial source for installed system files.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:36 npm install -g serve

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD runs 'npm install -g serve' during the package() function, which installs the 'serve' npm package globally into the build environment (and potentially the system) at package-build time rather than declaring it as a proper dependency. This is a real supply-chain concern: the 'serve' package is fetched from the npm registry at build time without any version pinning or integrity verification, meaning a compromised or malicious version of 'serve' could execute arbitrary code during packaging. Additionally, 'npm install -g' during package() is architecturally wrong — it installs into the live system rather than $pkgdir, so the package won't cleanly track or uninstall this dependency. The 'serve' package itself is a well-known npm package (by Vercel), so the risk is moderate rather than high, but the pattern of pulling an unpinned external npm package and installing it globally during packaging is a genuine supply-chain concern that warrants medium severity. The second git source from a personal maintainer repo (0xGingi/spacebarchat-client-aur) is used only for a systemd service file, which is lower risk but still worth noting as an unofficial source for installed system files.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: 0xGingi <0xgingi@0xgingi.com>
    
      2pkgname=('spacebar-client-git')
    
      3pkgver=r415.79345f7
    
      4pkgrel=1
    
      5pkgdesc="Open source, themeable and extendable discord-compatible native Spacebar client"
    
      6arch=('any')
    
      7url="https://github.com/spacebarchat/client"
    
      8license=('AGPL3')
    
      9makedepends=('git' 'nodejs' 'npm')
    
      10provides=('spacebar-client')
    
      11conflicts=('spacebar-client')
    
      12source=("git+https://github.com/spacebarchat/client.git" "git+https://github.com/0xGingi/spacebarchat-client-aur.git")
    
      13md5sums=('SKIP' 'SKIP')
    
      14
    
      15pkgver() {
    
      16  cd client
    
      17  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      18}
    
      19
    
      20prepare() {
    
      21	cd spacebarchat-client-aur
    
      22	sed -i "s|^User=.*\$|User=$USER|" spacebar-client.service 
    
      23}
    
      24
    
      25
    
      26build() {
    
      27    cd client
    
      28    npm install
    
      29    npm run build linux
    
      30}
    
      31
    
      32package() {
    
      33    cd client
    
      34    install -d ${pkgdir}/opt/spacebar-client
    
      35    cp -r build/* ${pkgdir}/opt/spacebar-client
    
      36    npm install -g serve
    
      37    cd ${srcdir}/spacebarchat-client-aur
    
      38    install -Dm0644 "spacebar-client.service" "${pkgdir}/etc/systemd/system/spacebar-client.service"
    
      39
    
      40	echo
    
      41	echo
    
      42	echo -------------------------------------------------------------
    
      43	echo 'Spacebar-Client is now installed!'
    
      44	echo 'Install location - /opt/spacebar-client'
    
      45	echo 'Systemd Service - /etc/systemd/system/spacebar-client.service'
    
      46	echo
    
      47	echo 'Start the client with sudo systemctl start spacebar-client'
    
      48	echo 'Spacebar-Client will start at http://localhost:3000'
    
      49	echo -------------------------------------------------------------
    
      50	echo
    
      51	echo
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2