I’m a Nix beginner myself but fetchurl and friends are themselves builders and the reason they are allowed to download something is that they require you to pass the SHA in as a parameter. Someone correct me if I’m wrong but this should be a “fixed-output derivation”. Read more about it here for example. In short, this let’s you download something while building, since you specified what the output must look like.
Long story short: I think you’re thinking of “I’ll let this JS code make network requests” but that’s really not ideal in a Nix environment. The ideal would be to handle the package in question separately, so that umami doesn’t need to request it through the network. If it wasn’t late already I’d give it a shot. I hope I remember to try tomorrow.
From your code snippet it looks like it’s really just trying to download some database file. You could try using fetchurl or fetchgit to download this file and then make it available in the builder for umami at whatever path umami would be looking for it.
Sorry for not supplying any code with this but I’ll hopefully try tomorrow 