yt-cli

maintainer Connor · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary archive from a personal domain (software.concise.cc) owned by the maintainer. While checksums (sha512 and md5) are provided and a PGP key is listed for validation, the source is not an official upstream release host (the upstream is GitLab). The package then runs 'yarn install' or 'npm install' inside the extracted node_modules directory at build/install time, which executes arbitrary npm lifecycle scripts from whatever packages are bundled or fetched. This combination — prebuilt binary from a personal host plus npm install execution — constitutes a genuine supply-chain concern: if the personal host is compromised or the maintainer pushes a malicious update, arbitrary code runs on the installer's machine. The PGP validation partially mitigates this if actually enforced by makepkg, but the overall pattern (personal binary host + npm install at build time) warrants medium severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "https://software.concise.cc/x86_64/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.xz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary archive from a personal domain (software.concise.cc) owned by the maintainer. While checksums (sha512 and md5) are provided and a PGP key is listed for validation, the source is not an official upstream release host (the upstream is GitLab). The package then runs 'yarn install' or 'npm install' inside the extracted node_modules directory at build/install time, which executes arbitrary npm lifecycle scripts from whatever packages are bundled or fetched. This combination — prebuilt binary from a personal host plus npm install execution — constitutes a genuine supply-chain concern: if the personal host is compromised or the maintainer pushes a malicious update, arbitrary code runs on the installer's machine. The PGP validation partially mitigates this if actually enforced by makepkg, but the overall pattern (personal binary host + npm install at build time) warrants medium severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Etherington <connor@concise.cc>
    
      2# ---
    
      3pkgname=yt-cli
    
      4pkgver=0.2.3
    
      5pkgrel=1
    
      6pkgdesc="A CLI YouTube client, with buit-in search and download capabilities."
    
      7arch=('any')
    
      8url="https://gitlab.com/a4to/${pkgname}"
    
      9license=('MIT')
    
      10depends=(mpv npm)
    
      11install="yt-cli.install"
    
      12source=(
    
      13  "https://software.concise.cc/x86_64/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.xz"
    
      14)
    
      15sha512sums=(
    
      16  '6f0291902f7467a45b7a00c633ae918ba3152c784b0f6168813653986f0b84c9e5320d5ed3ec9206148bc86874d7ecae2e6d887bbfda7fb37a13c3b78d0f898d'
    
      17)
    
      18md5sums=(
    
      19  'e58b26cc8d4c1f3e941800087b59b09d'
    
      20)
    
      21validpgpkeys=(
    
      22  '81BACEEBC3EA26E127166E4A819BB92A9A48160E'
    
      23)
    
      24
    
      25package() {
    
      26
    
      27  echo "${srcdir}/${pkgname}-${pkgver}-${pkgrel}-${arch}/usr/lib/node_modules/${pkgname}"
    
      28  [ -d "${srcdir}/${pkgname}-${pkgver}-${pkgrel}-${arch}/usr/lib/node_modules/${pkgname}" ] &&
    
      29    cd "${srcdir}/${pkgname}-${pkgver}-${pkgrel}-${arch}/usr/lib/node_modules/${pkgname}" ||
    
      30    cd "${srcdir}/${pkgname}/usr/lib/node_modules/${pkgname}"
    
      31
    
      32  which yarn >/dev/null 2>&1 && yarn install || npm install
    
      33
    
      34  cd ../../../../
    
      35
    
      36  install -dm0755 "${pkgdir}"/usr/lib/node_modules/${pkgname}
    
      37  install -Dm0644 usr/share/licenses/${pkgname}/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      38  install -Dm0644 usr/share/zsh/site-functions/_${pkgname} "$pkgdir/usr/share/zsh/site-functions/_${pkgname}"
    
      39
    
      40  !which ytcli >/dev/null 2>&1 && install -Dm0755 usr/bin/* -t "${pkgdir}/usr/bin/" ||
    
      41    install -Dm0755 usr/bin/${pkgname} "${pkgdir}/usr/bin/${pkgname}"
    
      42
    
      43  cp -ar usr/lib/node_modules/${pkgname}/* "${pkgdir}"/usr/lib/node_modules/${pkgname}
    
      44
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2