textlint-rule-write-good
LOW
maintainer orphaned
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The external download in package() is for a license file from a known MIT license generator site, not executable code, and the main source is verifiably from npmjs.org with a fixed checksum, making the overall risk low.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The external download in package() is for a license file from a known MIT license generator site, not executable code, and the main source is verifiably from npmjs.org with a fixed checksum, making the overall risk low.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:40
curl -sL http://nodaguti.mit-license.org -o ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: PY Chuang <pychuang@pm.me>
2
# Contributor: Arjun Nemani <nemaniarjun@gmail.com>
3
pkgname=textlint-rule-write-good
4
pkgver=2.0.0
5
pkgrel=1
6
pkgdesc='textlint rule to check your English style with write good'
7
arch=(any)
8
url='https://github.com/textlint-rule/textlint-rule-write-good'
9
license=('MIT')
10
depends=('nodejs' 'textlint')
11
makedepends=('npm')
12
source=(http://registry.npmjs.org/${pkgname}/-/${pkgname}-${pkgver}.tgz)
13
sha256sums=('aac60b0e34226c2ab7fb2a76dd35cce6ab9ad0c626abb8daf8960883823e1ad0')
14
15
package() {
16
cd ${srcdir}
17
18
# remove cache folder
19
if [[ -d npm-cache ]]; then rm -rf npm-cache; fi
20
21
# npm install with the local tarball
22
npm install \
23
--cache ${srcdir}/npm-cache \
24
--production \
25
--no-optional \
26
--no-audit \
27
-g \
28
--prefix ${pkgdir}/usr \
29
${pkgname}-${pkgver}.tgz
30
31
# change the destination of references
32
grep -Rl ${pkgdir} ${pkgdir} | xargs -r sed -i "s@${pkgdir}@@g"
33
grep -Rl ${srcdir} ${pkgdir} | xargs -r sed -i "s@\"${srcdir}.*\"@\"\"@g"
34
35
# install README
36
install -Dm644 ${srcdir}/package/ReadMe.md -t ${pkgdir}/usr/share/doc/${pkgname}
37
38
# install LICENSE (splitting sed to several lines for readability)
39
mkdir -p ${pkgdir}/usr/share/licenses/${pkgname}
40
curl -sL http://nodaguti.mit-license.org -o ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
41
sed -i -e '/<article>/,/<\/article>/!d' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
42
sed -i -e 's/^[[:blank:]]*//g; s/<[^>]*>//g' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
43
sed -i -e '/./,$!d' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
44
sed -i -e '${/^$/d;}' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
45
46
# change owner
47
chown -R root:root ${pkgdir}
48
}
49
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |