Are this packages secured?

[neelspoc32]

This might be a stupid thing for me to ask but while installing i got this err:

Are this packages secured?
From what I check on it does seem to, however some builds seem to have many issues opened. So I was wondering if they are flagged for vulnerabilities in recent attacks.

Also, if whether they're neccesary for the torlink to work?

[py-kalki]

Hi @neelspoc32 — great question, not stupid at all!

The EBUILDSCRIPT warning you're seeing is not a vulnerability — it's actually npm doing its job correctly. Since npm v9+, npm silently skips native postinstall scripts from indirect dependencies by default as a security precaution.

The packages flagged (bufferutil, node-datachannel, etc.) are all transitive dependencies of webtorrent, which is the core engine powering torlink. They are:

Safe — all are widely used, well-maintained packages
Necessary — especially bufferutil and node-datachannel for WebRTC peer-to-peer connections
If these native bindings fail to build, torlink will fall back gracefully to pure-JS alternatives (webtorrent handles this). Everything should work fine. If you're seeing actual runtime errors, feel free to share more details!