spacebar-client-git

maintainer skarbricat · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs 'npm install -g serve' during the package() function, which installs the 'serve' npm package globally into the build environment (and potentially the system) at package-build time rather than declaring it as a proper dependency. This is a real supply-chain concern: the 'serve' package is fetched from the npm registry at build time without any version pinning or integrity verification, meaning a compromised or malicious version of 'serve' could execute arbitrary code during packaging. Additionally, 'npm install -g' during package() is architecturally wrong — it installs into the live system rather than $pkgdir, so the package won't cleanly track or uninstall this dependency. The 'serve' package itself is a well-known npm package (by Vercel), so the risk is moderate rather than high, but the pattern of pulling an unpinned external npm package and installing it globally during packaging is a genuine supply-chain concern that warrants medium severity. The second git source from a personal maintainer repo (0xGingi/spacebarchat-client-aur) is used only for a systemd service file, which is lower risk but still worth noting as an unofficial source for installed system files.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:36 npm install -g serve

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD runs 'npm install -g serve' during the package() function, which installs the 'serve' npm package globally into the build environment (and potentially the system) at package-build time rather than declaring it as a proper dependency. This is a real supply-chain concern: the 'serve' package is fetched from the npm registry at build time without any version pinning or integrity verification, meaning a compromised or malicious version of 'serve' could execute arbitrary code during packaging. Additionally, 'npm install -g' during package() is architecturally wrong — it installs into the live system rather than $pkgdir, so the package won't cleanly track or uninstall this dependency. The 'serve' package itself is a well-known npm package (by Vercel), so the risk is moderate rather than high, but the pattern of pulling an unpinned external npm package and installing it globally during packaging is a genuine supply-chain concern that warrants medium severity. The second git source from a personal maintainer repo (0xGingi/spacebarchat-client-aur) is used only for a systemd service file, which is lower risk but still worth noting as an unofficial source for installed system files.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: 0xGingi <0xgingi@0xgingi.com>
    
      2pkgname=('spacebar-client-git')
    
      3pkgver=r415.79345f7
    
      4pkgrel=1
    
      5pkgdesc="Open source, themeable and extendable discord-compatible native Spacebar client"
    
      6arch=('any')
    
      7url="https://github.com/spacebarchat/client"
    
      8license=('AGPL3')
    
      9makedepends=('git' 'nodejs' 'npm')
    
      10provides=('spacebar-client')
    
      11conflicts=('spacebar-client')
    
      12source=("git+https://github.com/spacebarchat/client.git" "git+https://github.com/0xGingi/spacebarchat-client-aur.git")
    
      13md5sums=('SKIP' 'SKIP')
    
      14
    
      15pkgver() {
    
      16  cd client
    
      17  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      18}
    
      19
    
      20prepare() {
    
      21	cd spacebarchat-client-aur
    
      22	sed -i "s|^User=.*\$|User=$USER|" spacebar-client.service 
    
      23}
    
      24
    
      25
    
      26build() {
    
      27    cd client
    
      28    npm install
    
      29    npm run build linux
    
      30}
    
      31
    
      32package() {
    
      33    cd client
    
      34    install -d ${pkgdir}/opt/spacebar-client
    
      35    cp -r build/* ${pkgdir}/opt/spacebar-client
    
      36    npm install -g serve
    
      37    cd ${srcdir}/spacebarchat-client-aur
    
      38    install -Dm0644 "spacebar-client.service" "${pkgdir}/etc/systemd/system/spacebar-client.service"
    
      39
    
      40	echo
    
      41	echo
    
      42	echo -------------------------------------------------------------
    
      43	echo 'Spacebar-Client is now installed!'
    
      44	echo 'Install location - /opt/spacebar-client'
    
      45	echo 'Systemd Service - /etc/systemd/system/spacebar-client.service'
    
      46	echo
    
      47	echo 'Start the client with sudo systemctl start spacebar-client'
    
      48	echo 'Spacebar-Client will start at http://localhost:3000'
    
      49	echo -------------------------------------------------------------
    
      50	echo
    
      51	echo
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2