zen-browser-single-file

MEDIUM

maintainer Kimiblock 0 votes base firefox-browser-single-file scanned 2026-09-17 05:24:46.293726

View on AUR

Why flagged

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:24 npx rollup -c rollup.config.js

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kimiblock Moe
    
      2
    
      3pkgname=(zen-browser-single-file firefox-extension-single-file)
    
      4pkgbase=firefox-browser-single-file
    
      5pkgver=1.26.0
    
      6pkgrel=1
    
      7arch=('any')
    
      8url='https://github.com/gildas-lormeau/SingleFile'
    
      9license=('AGPL-3.0-only')
    
      10groups=('zen-browser-addons')
    
      11pkgdesc='Web Extension for saving a faithful copy of a complete web page in a single HTML file'
    
      12makedepends=('nodejs' 'npm' 'unzip' 'zip' 'git' 'jq')
    
      13source=("source::git+https://github.com/gildas-lormeau/SingleFile.git#tag=v${pkgver}")
    
      14b2sums=('da5d18f4e848962753a4cc0f1bada7f9ef0c0e51856f5bd7f80f6c4f892e79fcae0a42f3fe10138cc5790d5b5ef4b1ac2587df46639b8219684325897526ba99')
    
      15
    
      16prepare() {
    
      17  cd "${srcdir}/source"
    
      18  npm install
    
      19  npm update
    
      20}
    
      21
    
      22build() {
    
      23    cd "${srcdir}/source"
    
      24    npx rollup -c rollup.config.js
    
      25    cp package.json package.copy.json
    
      26    jq 'del(.dependencies."single-file-cli")' package.copy.json > package.json
    
      27    zip -r singlefile-extension-source.zip manifest.json package.json _locales src rollup*.js .eslintrc.js build-extension.sh
    
      28    mv package.copy.json package.json
    
      29    rm -f singlefile-extension-firefox.zip
    
      30    cp src/core/bg/config.js config.copy.js
    
      31    cp src/core/bg/companion.js companion.copy.js
    
      32    #sed -i "" 's/forceWebAuthFlow: false/forceWebAuthFlow: true/g' src/core/bg/config.js
    
      33    #sed -i "" 's/enabled: true/enabled: false/g' src/core/bg/companion.js
    
      34    zip -r singlefile-extension-firefox.zip manifest.json lib _locales src
    
      35    mv config.copy.js src/core/bg/config.js
    
      36    mv companion.copy.js src/core/bg/companion.js
    
      37}
    
      38
    
      39package_firefox-extension-single-file() {
    
      40    cd "${srcdir}/source"
    
      41    install -Dm644 "${srcdir}/source/singlefile-extension-firefox.zip" "${pkgdir}/usr/lib/firefox/browser/extensions/{531906d3-e22f-4a6c-a102-8057b88a1a63}.xpi"
    
      42}
    
      43
    
      44package_zen-browser-single-file() {
    
      45    cd "${srcdir}/source"
    
      46    install -Dm644 "${srcdir}/source/singlefile-extension-firefox.zip" "${pkgdir}/usr/lib/zen-browser/browser/extensions/{531906d3-e22f-4a6c-a102-8057b88a1a63}.xpi"
    
      47}
    
      48
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-09-17 00:27
+++ PKGBUILD @ 2026-09-17 05:24
@@ -2,7 +2,7 @@
 
 pkgname=(zen-browser-single-file firefox-extension-single-file)
 pkgbase=firefox-browser-single-file
-pkgver=1.25.0
+pkgver=1.26.0
 pkgrel=1
 arch=('any')
 url='https://github.com/gildas-lormeau/SingleFile'
@@ -11,7 +11,7 @@
 pkgdesc='Web Extension for saving a faithful copy of a complete web page in a single HTML file'
 makedepends=('nodejs' 'npm' 'unzip' 'zip' 'git' 'jq')
 source=("source::git+https://github.com/gildas-lormeau/SingleFile.git#tag=v${pkgver}")
-b2sums=('f7c8be37b2ce663e9e911ce68ae235b9e7da1751ab4403769a7e90d66fe01bc6909c95d0f5d9bdd4cc052b1525c6b9bff8a3faf321cd17d0cbd9c6cdf70092f7')
+b2sums=('da5d18f4e848962753a4cc0f1bada7f9ef0c0e51856f5bd7f80f6c4f892e79fcae0a42f3fe10138cc5790d5b5ef4b1ac2587df46639b8219684325897526ba99')
 
 prepare() {
   cd "${srcdir}/source"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 05:24:46	Medium	1
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 05:18:46	Medium	1
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 05:20:15	Medium	1
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 21:15:20	Medium	1
2026-09-07 00:30:15	Low	2
2026-09-06 05:10:24	Medium	1
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 21:54:41	Medium	1