registry / pacman-debian / 7.5.0

pacman-debian@7.5.0

A Debian/Ubuntu package manager using Arch Linux pacman syntax. Manages .deb packages at dpkg level, supports Arch .pkg.tar.zst, AUR helpers (yay), and makepkg. Configurable multi-repo setup.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 58 file(s), 378 KB of source, external domains: archive.ubuntu.com, mirror.archlinuxarm.org, mirrors.tuna.tsinghua.edu.cn, ports.ubuntu.com

Source & flagged code

4 flagged

package.jsonView file

Lines 22-62json

22 "README.md",

23 "README_zh-CN.md",

24 "package.json"

25 ],

26 "bin": {

27 "pacman": "dist/index.js",

28 "makepkg": "dist/makepkg/index.js",

29 "pacman-conf": "dist/scripts/pacman-conf.js",

30 "pacman-debian-setup": "dist/scripts/setup.js",

31 "paclink": "dist/cli/paclink.js",

32 "update-ca-trust": "dist/cli/update-ca-trust.js",

33 "archlinux-java": "dist/cli/archlinux-java.js",

34 "fix_default": "dist/cli/fix_default.js",

35 "pactree": "dist/cli/pactree.js"

36 },

37 "scripts": {

38 "build": "tsc && mkdir -p dist/lock && gcc -O2 -s -o dist/lock/dpkg-helper src/lock/dpkg-helper.c && make -s -C lib/pac4deb",

39 "build:lib": "make -C lib/pac4deb",

40 "setup": "sudo node dist/scripts/setup.js",

41 "start": "node dist/index.js",

42 "postinstall": "echo 'Run `sudo pacman-debian-setup` to complete installation.'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 "prepublishOnly": "pnpm build"

44 },

45 "keywords": [

46 "pacman",

47 "debian",

48 "ubuntu",

49 "package-manager",

50 "arch",

51 "aur",

52 "makepkg"

53 ],

54 "author": "Xbodwf",

55 "license": "GPL-3.0",

56 "repository": {

57 "type": "git",

58 "url": "git+https://github.com/Xbodwf/pacman-debian.git"

59 },

60 "bugs": {

61 "url": "https://github.com/Xbodwf/pacman-debian/issues"

62 },

dist/lock/dpkg-helperView file

•path = dist/lock/dpkg-helper kind = native_binary sizeBytes = 67704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/lock/dpkg-helperView on unpkg

lib/pac4deb/MakefileView file

•path = lib/pac4deb/Makefile kind = build_helper sizeBytes = 461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/pac4deb/MakefileView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = echo 'Run `sudo pacman-debian-setup` to complete installation.'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = echo 'Run `sudo pacman-debian-setup` to complete installation.'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lock/dpkg-helperView file

•path = dist/lock/dpkg-helper kind = native_binary sizeBytes = 67704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/lock/dpkg-helperView on unpkg

lib/pac4deb/MakefileView file

•path = lib/pac4deb/Makefile kind = build_helper sizeBytes = 461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/pac4deb/MakefileView on unpkg

Findings

1 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydist/lock/dpkg-helper

MediumShips Build Helperlib/pac4deb/Makefile

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

4 flagged

package.jsonView file

Lines 22-62json

22 "README.md",

23 "README_zh-CN.md",

24 "package.json"

25 ],

26 "bin": {

27 "pacman": "dist/index.js",

28 "makepkg": "dist/makepkg/index.js",

29 "pacman-conf": "dist/scripts/pacman-conf.js",

30 "pacman-debian-setup": "dist/scripts/setup.js",

31 "paclink": "dist/cli/paclink.js",

32 "update-ca-trust": "dist/cli/update-ca-trust.js",

33 "archlinux-java": "dist/cli/archlinux-java.js",

34 "fix_default": "dist/cli/fix_default.js",

35 "pactree": "dist/cli/pactree.js"

36 },

37 "scripts": {

38 "build": "tsc && mkdir -p dist/lock && gcc -O2 -s -o dist/lock/dpkg-helper src/lock/dpkg-helper.c && make -s -C lib/pac4deb",

39 "build:lib": "make -C lib/pac4deb",

40 "setup": "sudo node dist/scripts/setup.js",

41 "start": "node dist/index.js",

42 "postinstall": "echo 'Run `sudo pacman-debian-setup` to complete installation.'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 "prepublishOnly": "pnpm build"

44 },

45 "keywords": [

46 "pacman",

47 "debian",

48 "ubuntu",

49 "package-manager",

50 "arch",

51 "aur",

52 "makepkg"

53 ],

54 "author": "Xbodwf",

55 "license": "GPL-3.0",

56 "repository": {

57 "type": "git",

58 "url": "git+https://github.com/Xbodwf/pacman-debian.git"

59 },

60 "bugs": {

61 "url": "https://github.com/Xbodwf/pacman-debian/issues"

62 },

dist/lock/dpkg-helperView file

•path = dist/lock/dpkg-helper kind = native_binary sizeBytes = 67704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/lock/dpkg-helperView on unpkg

lib/pac4deb/MakefileView file

•path = lib/pac4deb/Makefile kind = build_helper sizeBytes = 461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/pac4deb/MakefileView on unpkg