weixinpay-ai-installer-bin

LOW

maintainer calmcrow 0 votes scanned 2026-09-25 07:10:52.990950

View on AUR

Why flagged

The package builds from an official npm registry source, installs only the project's own CLI tool, and does not execute arbitrary remote code or modify system components at install time; the license restriction on republishing does not imply malware but limits redistribution, making it a low-severity concern.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from an official npm registry source, installs only the project's own CLI tool, and does not execute arbitrary remote code or modify system components at install time; the license restriction on republishing does not imply malware but limits redistribution, making it a low-severity concern.

PKGBUILD

      1# Maintainer: calmcrow <calmcrow@outlook.com>
    
      2#
    
      3# ============================================================
    
      4#  weixinpay-ai-installer-bin - Third-party repackaging
    
      5# ============================================================
    
      6#  Wraps the npm distribution published by Tenpay (WeChat Pay)
    
      7#  into a pacman package. Only the installer CLI is shipped;
    
      8#  nothing is modified and no agent is touched at install time.
    
      9#
    
      10#  - Upstream: https://www.npmjs.com/package/@tenpay/weixinpay-ai-installer
    
      11#  - Usage:    weixinpay-ai-installer install [--host=openclaw|dsh|hermes]
    
      12#
    
      13#  The upstream license (LICENSE inside the tarball) is proprietary and
    
      14#  restricts re-publishing the artifacts, so this PKGBUILD downloads the
    
      15#  tarball straight from the npm registry at build time and never ships
    
      16#  it inside this repository.
    
      17
    
      18pkgname=weixinpay-ai-installer-bin
    
      19_npmver=1.1.0
    
      20pkgver=1.1.0
    
      21pkgrel=1
    
      22pkgdesc='WeChat Pay AI installer - one command to add WeChat AI payment capability to OpenClaw / DeepSeek Harness agents'
    
      23arch=('any')
    
      24url='https://www.npmjs.com/package/@tenpay/weixinpay-ai-installer'
    
      25license=('custom')
    
      26depends=('nodejs>=18')
    
      27makedepends=('npm')
    
      28provides=('weixinpay-ai-installer')
    
      29conflicts=('weixinpay-ai-installer')
    
      30options=('!strip')
    
      31install=weixinpay-ai-installer-bin.install
    
      32source=("weixinpay-ai-installer-${_npmver}.tgz::https://registry.npmjs.org/@tenpay/weixinpay-ai-installer/-/weixinpay-ai-installer-${_npmver}.tgz")
    
      33sha256sums=('9a4e865fd7ffaba25d64c1b0dbd33132f9fb81c06a173455ccd9ddda4c748a43')
    
      34
    
      35prepare() {
    
      36    rm -rf npm-root npm-cache
    
      37    mkdir -p npm-root/usr npm-cache
    
      38
    
      39    npm install --global \
    
      40        --prefix "$srcdir/npm-root/usr" \
    
      41        --cache "$srcdir/npm-cache" \
    
      42        --omit=dev \
    
      43        --omit=peer \
    
      44        --no-audit \
    
      45        --no-fund \
    
      46        --legacy-peer-deps \
    
      47        "$srcdir/weixinpay-ai-installer-${_npmver}.tgz"
    
      48}
    
      49
    
      50package() {
    
      51    cp -a "$srcdir/npm-root/usr/." "$pkgdir/usr/"
    
      52    install -Dm644 "$srcdir/package/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      53    find "$pkgdir/usr" -type d -exec chmod 755 {} +
    
      54    chown -R root:root "$pkgdir"
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-25 07:10:52	Low	2