Review Results

Comment

The change relaxes npm's script execution policy during package installation by adding --allow-scripts=keytar,sharp,sqlite3. This permits lifecycle scripts for native modules to run at packaging time, which is a meaningful increase in build-time code execution surface. However, the scripts are limited to well-known dependencies already expected in this package, and the install still targets only the package directory under $pkgdir with no obvious network fetch or privilege escalation added by the diff. I don't see evidence of a backdoor or persistence mechanism in this small change, but it does reduce the safety of the packaging step compared with the previous no-scripts install.

@@ -103,7 +103,9 @@ package_joplin() {
     # Install the package
     cd "${srcdir}/joplin-${pkgver}/packages/app-cli/build"
     npm pack
-    npm install -g --install-links --prefix "${pkgdir}/usr" *.tgz
+    npm install -g --install-links --prefix "${pkgdir}/usr" \
+        --allow-scripts=keytar,sharp,sqlite3 \
+        *.tgz
 
     # Fix permissions set by npm
     chown -R root:root "${pkgdir}"