Arch Linux

the symlinks have the executable bit set

$ pacman -Qlq nodejs-babel-cli | grep '/usr/bin/\w' | xargs ls -ld
lrwxrwxrwx 1 root root 42 20. Jan 02:44 /usr/bin/babel -> ../lib/node_modules/babel-cli/bin/babel.js
lrwxrwxrwx 1 root root 49 20. Jan 02:44 /usr/bin/babel-doctor -> ../lib/node_modules/babel-cli/bin/babel-doctor.js
lrwxrwxrwx 1 root root 59 20. Jan 02:44 /usr/bin/babel-external-helpers -> ../lib/node_modules/babel-cli/bin/babel-external-helpers.js
lrwxrwxrwx 1 root root 47 20. Jan 02:44 /usr/bin/babel-node -> ../lib/node_modules/babel-cli/bin/babel-node.js

but when following the symlinks, the linked-to scripts haven’t

$ pacman -Qlq nodejs-babel-cli | grep '/usr/bin/\w' | xargs ls -ldH
-rw-r--r-- 1 root root 46 8. Jan 15:01 /usr/bin/babel
-rw-r--r-- 1 root root 53 8. Jan 15:01 /usr/bin/babel-doctor
-rw-r--r-- 1 root root 63 8. Jan 15:01 /usr/bin/babel-external-helpers
-rw-r--r-- 1 root root 51 8. Jan 15:01 /usr/bin/babel-node

PS: how does the severity work? does “critical” mean “IT’S A SECURITY RISK!!!” or rather “the package doesn’t do at all what it’s supposed to do” or “it crashes at start”

because this is easily detectable and fixable with chmod +x, but still removes the usability of this package when untreated.