stremio-web
maintainer yobson
· 1 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The pnpm install of express@4 is a direct dependency needed for building the project, matches the upstream Dockerfile, and is not an undeclared external package in practice.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pnpm install of express@4 is a direct dependency needed for building the project, matches the upstream Dockerfile, and is not an undeclared external package in practice.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:34
pnpm install express@4
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: yobson <aur@yobson.xyz>
2
pkgname=stremio-web
3
pkgver=5.0.0_beta.39
4
pkgrel=1
5
pkgdesc="Stremio web client frontend"
6
arch=('x86_64')
7
url="https://github.com/Stremio/$pkgname"
8
license=('GPL-2.0-only')
9
depends=('nodejs')
10
makedepends=('nvm' 'pnpm' 'esbuild')
11
source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver//_/-}.tar.gz")
12
sha256sums=('e1b5d50b55afbcb1ca1da1c9cb1edd030d9d9aeffd53fc38abbb270b66fc268c')
13
14
# https://wiki.archlinux.org/title/Node.js_package_guidelines#Using_nvm
15
_ensure_local_nvm() {
16
which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
17
export NVM_DIR="${srcdir}/.nvm"
18
19
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
20
}
21
22
prepare() {
23
cd "$srcdir/$pkgname-${pkgver//_/-}"
24
25
# patch webpack config to use pkgver instead of a commit hash
26
# since our source is just a tarball, not a git repo
27
sed -i "s|execSync('git rev-parse HEAD').toString().trim()|'${pkgver}-${pkgrel}-AUR'|" webpack.config.js
28
# patch http_server.js to use where stremio-web is to be installed
29
sed -i "s|path.resolve(__dirname, 'build')|'/usr/share/stremio-web'|" http_server.js
30
31
_ensure_local_nvm
32
nvm install
33
pnpm clean-install
34
pnpm install express@4 # https://github.com/Stremio/stremio-web/blob/development/Dockerfile#L30
35
}
36
37
build() {
38
cd "$srcdir/$pkgname-${pkgver//_/-}"
39
40
_ensure_local_nvm
41
pnpm run build
42
esbuild http_server.js --bundle --platform=node --outfile=stremio-web-server.js
43
}
44
45
package() {
46
cd "$srcdir/$pkgname-${pkgver//_/-}"
47
48
install -d "$pkgdir/usr/share/stremio-web"
49
cp -r build/* "$pkgdir/usr/share/stremio-web/"
50
install -Dm755 stremio-web-server.js "$pkgdir/usr/bin/stremio-web"
51
}
52
Changes since previous scan
--- PKGBUILD @ 2026-07-30 00:17+++ PKGBUILD @ 2026-08-03 00:08@@ -31,7 +31,7 @@ _ensure_local_nvm nvm install pnpm clean-install- pnpm install express@4+ pnpm install express@4 # https://github.com/Stremio/stremio-web/blob/development/Dockerfile#L30 } build() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 21:16:48 | MEDIUM | 1 |
| 2026-07-30 19:16:23 | MEDIUM | 1 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 15:35:03 | MEDIUM | 1 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |