i2p-dev 2.3.0.10-1
A distributed anonymous network (daily mtn->git sync)
config.json file.
/v1/packages/i2p-dev/versions SHAs are authoritative.
Metadata
Relations
Depends
Make dependencies
Conflicts
Provides
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| f9cc59521747head | verified | 2026-11-05 16:11 | 16 |
Head findings
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
printf "%s.%s" "$(grep -m1 ' VERSION =' core/java/src/net/i2p/CoreVersion.java \
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
|sed 's/.*= "//;s/";//')" "$(grep 'BUILD =' router/java/src/net/i2p/router/RouterVersion.java \
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
ant -Dworkspace.version="$(git rev-parse --short $_commit)" \
risky-tool
in
PKGBUILD'ant' is invoked - this fetches/executes external code outside alpm's control.
ant -Dworkspace.version="$(git rev-parse --short $_commit)" \
command-substitution
in
i2prouter.bashDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )command-substitution
in
i2prouter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
if [[ "$(id -un)" != "$I2P_USER" ]]; then
command-substitution
in
i2prouter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
SCRIPT_PATH="$(cd "$(dirname $0)" && pwd)/$(basename $0)"
privilege-escalation
in
i2prouter.shPrivilege escalation tool 'su' is invoked inside a packaged helper script - helper scripts only run when the user invokes them voluntarily, typically with the privileges they already hold.
su - "$I2P_USER" -c "${SCRIPT_PATH} $@"command-substitution
in
i2prouter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
pid=$(cat "$PIDFILE")
command-substitution
in
i2prouter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
pid=$(get_pid)
command-substitution
in
i2prouter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
[[ "$pid" -ne "$(get_pid)" ]] &&
command-substitution
in
i2prouter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
[[ $(get_pid) ]] &&
command-substitution
in
i2prouter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
kill -USR1 "$(get_wrapper_pid)" || echo "I2P Router is not running"
command-substitution
in
i2prouter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
[[ ! $(get_pid) ]] && unset pid
command-substitution
in
i2prouter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
[[ ! $(get_pid) ]] && unset pid
command-substitution
in
i2prouter.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
echo "Usage: $(basename $0) <command>"
Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.