joplin

LOW

maintainer cuihao 288 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx commands are used to run build tools (yarn, gulp, electron-builder) on the project's own source code from a trusted GitHub repository, not to execute arbitrary remote packages.

Triggered rules

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The npx commands are used to run build tools (yarn, gulp, electron-builder) on the project's own source code from a trusted GitHub repository, not to execute arbitrary remote packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:61 npx yarn install
PKGBUILD:69 npx gulp build
PKGBUILD:73 npx gulp before-dist
PKGBUILD:80 npx electron-builder \
PKGBUILD:93 npx yarn workspaces foreach -Rptiv --from 'joplin' --from '@joplin/app-desktop' run test

PKGBUILD

5 offending line(s) highlighted

      1# Maintainer: CUI Hao <cuihao.leo@gmail.com>
    
      2# Contributor: dosenpils <dosenpils at donotdevelopmyapp dot com>
    
      3# Contributor: Alfredo Palhares <alfredo at palhares dot me>
    
      4# Contributor: Mark Wagie <mark dot wagie at tutanota dot com>
    
      5# Contributor: Matteo Parolari
    
      6# Contributor: gardar <aur@gardar.net>
    
      7
    
      8pkgbase=joplin
    
      9pkgname=('joplin' 'joplin-desktop')
    
      10pkgdesc="A note taking and to-do application with synchronization capabilities"
    
      11pkgver=3.6.16
    
      12groups=('joplin')
    
      13pkgrel=1
    
      14_electronVersion=42
    
      15depends=("electron${_electronVersion}" "nodejs>20" "libvips")
    
      16optdepends=('libappindicator-gtk3: for tray icon')
    
      17arch=('x86_64' 'aarch64')
    
      18makedepends=('npm' 'git' 'rsync' 'python-setuptools' 'libxcrypt-compat' 'corepack')
    
      19url="https://joplinapp.org/"
    
      20license=("AGPL-3.0-or-later")
    
      21source=(
    
      22    "joplin-desktop.sh"
    
      23    "joplin-desktop.desktop"
    
      24    "joplin-${pkgver}.tar.gz::https://github.com/laurent22/joplin/archive/v${pkgver}.tar.gz"
    
      25)
    
      26sha256sums=('9223cc816f8175ddaf8839f9357d2bd1c4831692504927c98d8e1eefa7df796e'
    
      27            'f485c089904d91750d137d4413297676446e0068892cb08e20bee928bcac516c'
    
      28            'f88de7ccc464dcab925966e35ffa4a061551593749589ef74ce4683977df8c35')
    
      29
    
      30_setup_env() {
    
      31    export YARN_CACHE_FOLDER="${srcdir}/yarn-cache"
    
      32    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      33    #export npm_config_build_from_source=true
    
      34    export npm_config_yes=true
    
      35    export SHARP_IGNORE_GLOBAL_LIBVIPS=1
    
      36}
    
      37
    
      38prepare() {
    
      39    _setup_env
    
      40
    
      41    # Create the yarn cache folder
    
      42    mkdir -p "${YARN_CACHE_FOLDER}"
    
      43
    
      44    cd "${srcdir}/joplin-${pkgver}"
    
      45}
    
      46
    
      47build() {
    
      48    _setup_env
    
      49
    
      50    cd "${srcdir}/joplin-${pkgver}"
    
      51
    
      52    # Delete unused components
    
      53    rm -r packages/{app-mobile,app-clipper,server,doc-builder}
    
      54    # Fix: Build error due to removal of app-mobile
    
      55    sed -i '/app-mobile\//d' packages/tools/gulp/tasks/buildScriptIndexes.js
    
      56
    
      57    # Fix: joplin-plugin-freehand-drawing complains "not in a git directory"
    
      58    git init
    
      59
    
      60    corepack install
    
      61    npx yarn install
    
      62
    
      63    # Replace npm dependencies with local ones
    
      64    cd "packages"
    
      65    sed -i -E 's_"@joplin/(\w+)": .*_"@joplin/\1": "file://'$PWD'/\1",_g' */package.json
    
      66
    
      67    # Pack the app-cli package
    
      68    cd "${srcdir}/joplin-${pkgver}/packages/app-cli"
    
      69    npx gulp build
    
      70
    
      71    # Pack the app-desktop electron package
    
      72    cd "${srcdir}/joplin-${pkgver}/packages/app-desktop"
    
      73    npx gulp before-dist
    
      74    electronRoot=/usr/lib/electron${_electronVersion}/
    
      75    electronVersion="$(<${electronRoot}/version)"
    
      76    arch_args="--x64"
    
      77    if [[ $CARCH == "aarch64" ]]; then
    
      78        arch_args="--arm64"
    
      79    fi
    
      80    npx electron-builder \
    
      81      --linux "$arch_args" --dir=dist/ \
    
      82      -c.electronDist="${electronRoot}" \
    
      83      -c.electronVersion="${electronVersion}"
    
      84}
    
      85
    
      86check() {
    
      87    _setup_env
    
      88
    
      89    cd "${srcdir}/joplin-${pkgver}"
    
      90
    
      91    env ELECTRON_OVERRIDE_DIST_PATH=/usr/lib/electron${_electronVersion}/ \
    
      92        TZ=UTC \
    
      93        npx yarn workspaces foreach -Rptiv --from 'joplin' --from '@joplin/app-desktop' run test
    
      94}
    
      95
    
      96package_joplin() {
    
      97    pkgdesc="A note taking and to-do application with synchronization capabilities - CLI App"
    
      98    depends=('nodejs')
    
      99    optdepends=( )
    
      100
    
      101    _setup_env
    
      102
    
      103    # Install the package
    
      104    cd "${srcdir}/joplin-${pkgver}/packages/app-cli/build"
    
      105    npm pack
    
      106    npm install -g --install-links --prefix "${pkgdir}/usr" \
    
      107        --allow-scripts=keytar,sharp,sqlite3 \
    
      108        *.tgz
    
      109
    
      110    # Fix permissions set by npm
    
      111    chown -R root:root "${pkgdir}"
    
      112}
    
      113
    
      114package_joplin-desktop() {
    
      115    pkgdesc="A note taking and to-do application with synchronization capabilities - Desktop"
    
      116    depends=("electron${_electronVersion}" "nodejs" "libvips")
    
      117    optdepends=('libappindicator-gtk3: for tray icon')
    
      118
    
      119    _setup_env
    
      120
    
      121    cd "${srcdir}/joplin-${pkgver}/packages/app-desktop"
    
      122    mkdir -p "${pkgdir}/usr/lib"
    
      123    cp -vr dist/linux-unpacked/resources "${pkgdir}/usr/lib/${pkgname}"
    
      124
    
      125    # Install icons
    
      126    while read -r size; do
    
      127        mkdir -p "${pkgdir}/usr/share/icons/hicolor/${size}/apps/"
    
      128        cp "${pkgdir}/usr/lib/${pkgname}/build/icons/${size}.png" \
    
      129           "${pkgdir}/usr/share/icons/hicolor/${size}/apps/${pkgname}.png"
    
      130    done < <(ls build/icons | grep -Po '^(\d+)x\1+(?=\.png)')
    
      131
    
      132    install -vDm644 "${srcdir}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      133    install -vDm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      134    sed -i "s|@electronversion@|${_electronVersion}|" "${pkgdir}/usr/bin/${pkgname}"
    
      135}
    
      136

Changes since previous scan

--- PKGBUILD @ 2026-09-11 00:19
+++ PKGBUILD @ 2026-09-17 00:27
@@ -8,10 +8,10 @@
 pkgbase=joplin
 pkgname=('joplin' 'joplin-desktop')
 pkgdesc="A note taking and to-do application with synchronization capabilities"
-pkgver=3.6.15
+pkgver=3.6.16
 groups=('joplin')
 pkgrel=1
-_electronVersion=41
+_electronVersion=42
 depends=("electron${_electronVersion}" "nodejs>20" "libvips")
 optdepends=('libappindicator-gtk3: for tray icon')
 arch=('x86_64' 'aarch64')
@@ -25,7 +25,7 @@
 )
 sha256sums=('9223cc816f8175ddaf8839f9357d2bd1c4831692504927c98d8e1eefa7df796e'
             'f485c089904d91750d137d4413297676446e0068892cb08e20bee928bcac516c'
-            '8ed300da2e71effb5550cee66e5e77d082d8dcf93c2914c5d1cb6fac58e6ffbc')
+            'f88de7ccc464dcab925966e35ffa4a061551593749589ef74ce4683977df8c35')
 
 _setup_env() {
     export YARN_CACHE_FOLDER="${srcdir}/yarn-cache"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 23:24:29	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 21:44:16	Low	2