textlint-rule-ginger

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The external download is only for a license file from a non-whitelisted but legitimate host, which is then cleaned and installed as static text; the actual package source comes from npmjs.org in the source array and is verified by checksum, so there is no risk of remote code execution or supply chain attack.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The external download is only for a license file from a non-whitelisted but legitimate host, which is then cleaned and installed as static text; the actual package source comes from npmjs.org in the source array and is verified by checksum, so there is no risk of remote code execution or supply chain attack.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:39 curl -sL http://nodaguti.mit-license.org -o ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: PY Chuang <pychuang@pm.me>
    
      2pkgname=textlint-rule-ginger
    
      3pkgver=2.2.1
    
      4pkgrel=2
    
      5pkgdesc='textlint rule to check your English grammar with Ginger Proofreading'
    
      6arch=(any)
    
      7url='https://github.com/textlint-rule/textlint-rule-ginger'
    
      8license=('MIT')
    
      9depends=('nodejs' 'textlint')
    
      10makedepends=('npm')
    
      11source=(http://registry.npmjs.org/${pkgname}/-/${pkgname}-${pkgver}.tgz)
    
      12sha256sums=('464cbe8a5e1e2fe550b875da5af1c185a5f91cbd6ffcca6871be8dbf06cd3b3e')
    
      13
    
      14package() {
    
      15    cd ${srcdir}
    
      16
    
      17    # remove cache folder
    
      18    if [[ -d npm-cache ]]; then rm -rf npm-cache; fi
    
      19
    
      20    # npm install with the local tarball
    
      21    npm install \
    
      22        --cache ${srcdir}/npm-cache \
    
      23        --production \
    
      24        --no-optional \
    
      25        --no-audit \
    
      26        -g \
    
      27        --prefix ${pkgdir}/usr \
    
      28        ${pkgname}-${pkgver}.tgz
    
      29
    
      30    # change the destination of references
    
      31    grep -Rl ${pkgdir} ${pkgdir} | xargs -r sed -i "s@${pkgdir}@@g"
    
      32    grep -Rl ${srcdir} ${pkgdir} | xargs -r sed -i "s@\"${srcdir}.*\"@\"\"@g"
    
      33
    
      34    # install README
    
      35    install -Dm644 ${srcdir}/package/ReadMe.md -t ${pkgdir}/usr/share/doc/${pkgname}
    
      36
    
      37    # install LICENSE (splitting sed to several lines for readability)
    
      38    mkdir -p ${pkgdir}/usr/share/licenses/${pkgname}
    
      39    curl -sL http://nodaguti.mit-license.org -o ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      40    sed -i -e '/<article>/,/<\/article>/!d' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      41    sed -i -e 's/^[[:blank:]]*//g; s/<[^>]*>//g' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      42    sed -i -e '/./,$!d' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      43    sed -i -e '${/^$/d;}' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      44
    
      45    # change owner
    
      46    chown -R root:root ${pkgdir}
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2