textlint-rule-write-good
LOW
maintainer orphaned
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The external download in package() is for a license file from a known MIT license generator site, not executable code, and the main source is verifiably from npmjs.org with a fixed checksum, making the overall risk low.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The external download in package() is for a license file from a known MIT license generator site, not executable code, and the main source is verifiably from npmjs.org with a fixed checksum, making the overall risk low.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:40
curl -sL http://nodaguti.mit-license.org -o ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: PY Chuang <pychuang@pm.me>
2
# Contributor: Arjun Nemani <nemaniarjun@gmail.com>
3
pkgname=textlint-rule-write-good
4
pkgver=2.0.0
5
pkgrel=1
6
pkgdesc='textlint rule to check your English style with write good'
7
arch=(any)
8
url='https://github.com/textlint-rule/textlint-rule-write-good'
9
license=('MIT')
10
depends=('nodejs' 'textlint')
11
makedepends=('npm')
12
source=(http://registry.npmjs.org/${pkgname}/-/${pkgname}-${pkgver}.tgz)
13
sha256sums=('aac60b0e34226c2ab7fb2a76dd35cce6ab9ad0c626abb8daf8960883823e1ad0')
14
15
package() {
16
cd ${srcdir}
17
18
# remove cache folder
19
if [[ -d npm-cache ]]; then rm -rf npm-cache; fi
20
21
# npm install with the local tarball
22
npm install \
23
--cache ${srcdir}/npm-cache \
24
--production \
25
--no-optional \
26
--no-audit \
27
-g \
28
--prefix ${pkgdir}/usr \
29
${pkgname}-${pkgver}.tgz
30
31
# change the destination of references
32
grep -Rl ${pkgdir} ${pkgdir} | xargs -r sed -i "s@${pkgdir}@@g"
33
grep -Rl ${srcdir} ${pkgdir} | xargs -r sed -i "s@\"${srcdir}.*\"@\"\"@g"
34
35
# install README
36
install -Dm644 ${srcdir}/package/ReadMe.md -t ${pkgdir}/usr/share/doc/${pkgname}
37
38
# install LICENSE (splitting sed to several lines for readability)
39
mkdir -p ${pkgdir}/usr/share/licenses/${pkgname}
40
curl -sL http://nodaguti.mit-license.org -o ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
41
sed -i -e '/<article>/,/<\/article>/!d' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
42
sed -i -e 's/^[[:blank:]]*//g; s/<[^>]*>//g' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
43
sed -i -e '/./,$!d' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
44
sed -i -e '${/^$/d;}' ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
45
46
# change owner
47
chown -R root:root ${pkgdir}
48
}
49
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |