Arch Linux User Repository

@sun_lmao I have updated the PKGBUILD to allow all versions of nodejs. However, Mozilla recommends using the LTS version, so if there are any problems in building in the future, also try using the LTS version.

You can run npm audit fix after the npm ci command. However, this version (10.3.0) does not build if this command is ran.

It's not only the current AUR attack ... independently of this, npm is being attacked more or less constantly since quite a while ... speaking of "Shai Hulud" etc ...

web-ext needs to have access to my amo-upload-uuid in order to work at all, so if this package (or its dependencies) has vulnerabilities, it may steal it. Making this a sensitive package.

How do I do a "audit fix" during package build?

Hi, The affected npm package is atomic-lockfile, which, according to npm, was created 2 days ago. So web-ext should certainly not be affected by this attack. It is affecting AUR packages that were created/adopted by the attacker themselves.

The audit is not performed, because it may break package dependencies. You can either run npm audit fix yourself, or you can wait for Mozilla for a new release, so that these vulnerabilities are fixed.

https://www.npmjs.com/package/atomic-lockfile

During build, I get these messages:

8 vulnerabilities (1 low, 4 moderate, 1 high, 2 critical)  
To address issues that do not require attention, run:  
   npm audit fix

but I could not find out if the audit is actually performed. I also could not find out what these vulnerabilities exactly are.

Because of the current npm supply chain attack situation, I'd like to be better safe than sorry. Can someone shed some light on it?

@binarynoise, I am able to reproduce this with LANG=de_DE.UTF-8. Looks like it fails the testing process. I will update this comment with the issue I will be creating upstream. Thanks.

Edit: https://github.com/mozilla/web-ext/issues/3676

Edit 2: I have added a workaround to the PKGBUILD, by running npm test with LANG=C, until the issue is resolved upstream.

I currently have nodejs-lts-krypton installed. I have set my locale to German.

@binarynoise, try using the LTS version (nodejs-lts). Also, which locale are you using?

I can't build the package:

AssertionError: expected 'Unbekanntes Argument: nope' to match /Unknown argument: nope/

Is this fixable here or does this need to be fixed upstream? export LANG=C before building works around that problem but is quite annoying

@sun_lmao I have updated the PKGBUILD to allow all versions of nodejs. However, Mozilla recommends using the LTS version, so if there are any problems in building in the future, also try using the LTS version.

Please change dependency nodejs-lts to nodejs. This is a real annoyance and I don't see why it would need to be the LTS version.