joplin-desktop

maintainer cuihao · 287 votes · base joplin · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx commands are used to run build tools (yarn, gulp, electron-builder) during packaging from the project's own source code, which is downloaded from the official GitHub repository; this is standard practice and does not execute untrusted remote code.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The npx commands are used to run build tools (yarn, gulp, electron-builder) during packaging from the project's own source code, which is downloaded from the official GitHub repository; this is standard practice and does not execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:61 npx yarn install
PKGBUILD:69 npx gulp build
PKGBUILD:73 npx gulp before-dist
PKGBUILD:80 npx electron-builder \
PKGBUILD:93 npx yarn workspaces foreach -Rptiv --from 'joplin' --from '@joplin/app-desktop' run test

PKGBUILD

5 offending line(s) highlighted

      1# Maintainer: CUI Hao <cuihao.leo@gmail.com>
    
      2# Contributor: dosenpils <dosenpils at donotdevelopmyapp dot com>
    
      3# Contributor: Alfredo Palhares <alfredo at palhares dot me>
    
      4# Contributor: Mark Wagie <mark dot wagie at tutanota dot com>
    
      5# Contributor: Matteo Parolari
    
      6# Contributor: gardar <aur@gardar.net>
    
      7
    
      8pkgbase=joplin
    
      9pkgname=('joplin' 'joplin-desktop')
    
      10pkgdesc="A note taking and to-do application with synchronization capabilities"
    
      11pkgver=3.6.15
    
      12groups=('joplin')
    
      13pkgrel=1
    
      14_electronVersion=41
    
      15depends=("electron${_electronVersion}" "nodejs>20" "libvips")
    
      16optdepends=('libappindicator-gtk3: for tray icon')
    
      17arch=('x86_64' 'aarch64')
    
      18makedepends=('npm' 'git' 'rsync' 'python-setuptools' 'libxcrypt-compat' 'corepack')
    
      19url="https://joplinapp.org/"
    
      20license=("AGPL-3.0-or-later")
    
      21source=(
    
      22    "joplin-desktop.sh"
    
      23    "joplin-desktop.desktop"
    
      24    "joplin-${pkgver}.tar.gz::https://github.com/laurent22/joplin/archive/v${pkgver}.tar.gz"
    
      25)
    
      26sha256sums=('9223cc816f8175ddaf8839f9357d2bd1c4831692504927c98d8e1eefa7df796e'
    
      27            'f485c089904d91750d137d4413297676446e0068892cb08e20bee928bcac516c'
    
      28            '8ed300da2e71effb5550cee66e5e77d082d8dcf93c2914c5d1cb6fac58e6ffbc')
    
      29
    
      30_setup_env() {
    
      31    export YARN_CACHE_FOLDER="${srcdir}/yarn-cache"
    
      32    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      33    #export npm_config_build_from_source=true
    
      34    export npm_config_yes=true
    
      35    export SHARP_IGNORE_GLOBAL_LIBVIPS=1
    
      36}
    
      37
    
      38prepare() {
    
      39    _setup_env
    
      40
    
      41    # Create the yarn cache folder
    
      42    mkdir -p "${YARN_CACHE_FOLDER}"
    
      43
    
      44    cd "${srcdir}/joplin-${pkgver}"
    
      45}
    
      46
    
      47build() {
    
      48    _setup_env
    
      49
    
      50    cd "${srcdir}/joplin-${pkgver}"
    
      51
    
      52    # Delete unused components
    
      53    rm -r packages/{app-mobile,app-clipper,server,doc-builder}
    
      54    # Fix: Build error due to removal of app-mobile
    
      55    sed -i '/app-mobile\//d' packages/tools/gulp/tasks/buildScriptIndexes.js
    
      56
    
      57    # Fix: joplin-plugin-freehand-drawing complains "not in a git directory"
    
      58    git init
    
      59
    
      60    corepack install
    
      61    npx yarn install
    
      62
    
      63    # Replace npm dependencies with local ones
    
      64    cd "packages"
    
      65    sed -i -E 's_"@joplin/(\w+)": .*_"@joplin/\1": "file://'$PWD'/\1",_g' */package.json
    
      66
    
      67    # Pack the app-cli package
    
      68    cd "${srcdir}/joplin-${pkgver}/packages/app-cli"
    
      69    npx gulp build
    
      70
    
      71    # Pack the app-desktop electron package
    
      72    cd "${srcdir}/joplin-${pkgver}/packages/app-desktop"
    
      73    npx gulp before-dist
    
      74    electronRoot=/usr/lib/electron${_electronVersion}/
    
      75    electronVersion="$(<${electronRoot}/version)"
    
      76    arch_args="--x64"
    
      77    if [[ $CARCH == "aarch64" ]]; then
    
      78        arch_args="--arm64"
    
      79    fi
    
      80    npx electron-builder \
    
      81      --linux "$arch_args" --dir=dist/ \
    
      82      -c.electronDist="${electronRoot}" \
    
      83      -c.electronVersion="${electronVersion}"
    
      84}
    
      85
    
      86check() {
    
      87    _setup_env
    
      88
    
      89    cd "${srcdir}/joplin-${pkgver}"
    
      90
    
      91    env ELECTRON_OVERRIDE_DIST_PATH=/usr/lib/electron${_electronVersion}/ \
    
      92        TZ=UTC \
    
      93        npx yarn workspaces foreach -Rptiv --from 'joplin' --from '@joplin/app-desktop' run test
    
      94}
    
      95
    
      96package_joplin() {
    
      97    pkgdesc="A note taking and to-do application with synchronization capabilities - CLI App"
    
      98    depends=('nodejs')
    
      99    optdepends=( )
    
      100
    
      101    _setup_env
    
      102
    
      103    # Install the package
    
      104    cd "${srcdir}/joplin-${pkgver}/packages/app-cli/build"
    
      105    npm pack
    
      106    npm install -g --install-links --prefix "${pkgdir}/usr" *.tgz
    
      107
    
      108    # Fix permissions set by npm
    
      109    chown -R root:root "${pkgdir}"
    
      110}
    
      111
    
      112package_joplin-desktop() {
    
      113    pkgdesc="A note taking and to-do application with synchronization capabilities - Desktop"
    
      114    depends=("electron${_electronVersion}" "nodejs" "libvips")
    
      115    optdepends=('libappindicator-gtk3: for tray icon')
    
      116
    
      117    _setup_env
    
      118
    
      119    cd "${srcdir}/joplin-${pkgver}/packages/app-desktop"
    
      120    mkdir -p "${pkgdir}/usr/lib"
    
      121    cp -vr dist/linux-unpacked/resources "${pkgdir}/usr/lib/${pkgname}"
    
      122
    
      123    # Install icons
    
      124    while read -r size; do
    
      125        mkdir -p "${pkgdir}/usr/share/icons/hicolor/${size}/apps/"
    
      126        cp "${pkgdir}/usr/lib/${pkgname}/build/icons/${size}.png" \
    
      127           "${pkgdir}/usr/share/icons/hicolor/${size}/apps/${pkgname}.png"
    
      128    done < <(ls build/icons | grep -Po '^(\d+)x\1+(?=\.png)')
    
      129
    
      130    install -vDm644 "${srcdir}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      131    install -vDm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      132    sed -i "s|@electronversion@|${_electronVersion}|" "${pkgdir}/usr/bin/${pkgname}"
    
      133}
    
      134

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2