electron-notes-git
LOW
maintainer zxp19821005
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The npx command runs 'electron-vite build' and 'electron-builder', which are standard build tools for Electron apps sourced from the project's own package.json; this is normal build behavior, not execution of untrusted remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs 'electron-vite build' and 'electron-builder', which are standard build tools for Electron apps sourced from the project's own package.json; this is normal build behavior, not execution of untrusted remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:101
npx electron-vite build
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=electron-notes-git
3
_pkgname=Electron-Notes
4
pkgver=1.6.0.r0.gbbd2a58
5
_electronversion=25
6
_nodeversion=20
7
pkgrel=1
8
pkgdesc="A notes taking application that simple sleek and a fun way to handle your notes and comes with a brother mobile application where you can manage and synchronize your notes cross platform."
9
arch=('any')
10
url="https://snapcraft.io/web-notes"
11
_ghurl="https://github.com/RyanLarge13/Electron-Notes"
12
license=('MIT')
13
conflicts=("${pkgname%-git}")
14
provides=("${pkgname%-git}=${pkgver%.r*}")
15
depends=(
16
"electron${_electronversion}-bin"
17
)
18
makedepends=(
19
'gendesk'
20
'npm'
21
'nvm'
22
'git'
23
'jq'
24
)
25
source=(
26
"${pkgname%-git}.git::git+${_ghurl}"
27
"${pkgname%-git}.sh"
28
)
29
sha256sums=('SKIP'
30
'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
31
_get_project_dir() {
32
local d
33
while IFS= read -r d; do
34
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
35
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
36
}
37
pkgver() {
38
cd "$(_get_project_dir)"
39
set -o pipefail
40
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
41
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
42
}
43
_ensure_local_nvm() {
44
local NVM_DIR="${srcdir}/.nvm"
45
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
46
nvm install "${_nodeversion}"
47
nvm use "${_nodeversion}"
48
}
49
_get_app_dir() {
50
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
51
}
52
_get_electron_version() {
53
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
54
| xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
55
| grep -oE '[0-9]+' | head -1)
56
[[ -z "${_elec_ver}" ]] && return 1
57
(( _elec_ver == _electronversion )) && c=32 || c=31
58
echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
59
}
60
_set_build_env() {
61
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
62
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
63
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
64
export ELECTRON_BUILDER_OFFLINE=true
65
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
66
export HOME="${srcdir}/.home"
67
export XDG_CACHE_HOME="${HOME}/.cache"
68
export XDG_CONFIG_HOME="${HOME}/.config"
69
export XDG_DATA_HOME="${HOME}/.local/share"
70
export npm_config_cache="${HOME}/.npm_cache"
71
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
72
export COREPACK_HOME="${HOME}/.corepack"
73
export npm_config_audit=false
74
export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
75
mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
76
}
77
prepare() {
78
cd "$(_get_project_dir)"
79
sed -i -e "
80
s/@electronversion@/${_electronversion}/g
81
s/@appname@/${pkgname%-git}/g
82
" "${srcdir}/${pkgname%-git}.sh"
83
gendesk -q -f -n \
84
--pkgname="${pkgname%-git}" \
85
--pkgdesc="${pkgdesc}" \
86
--categories="Utility" \
87
--name="${_pkgname}" \
88
--exec="${pkgname%-git} %U"
89
_ensure_local_nvm
90
_set_build_env
91
sed -i "/openDevTools/d" src/main/index.ts
92
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
93
export NODE_ENV=development
94
npm install --leagcy-peer-deps
95
}
96
build() {
97
cd "$(_get_project_dir)"
98
_ensure_local_nvm
99
_set_build_env
100
export NODE_ENV=production
101
npx electron-vite build
102
npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
103
}
104
package() {
105
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
106
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
107
rm -rf "$(_get_app_dir)/resources/default_app.asar"
108
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
109
install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
110
install -Dm644 "$(_get_project_dir)/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
111
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
112
}
113
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 09:16:20 | Medium | 1 |