note-mark-git
The package builds from source hosted on GitHub, uses standard Node.js/Electron tooling with locked versions, and installs only project-owned dependencies; the variable-named package install via yarn is part of normal build workflow and not a supply-chain risk.
Triggered rules
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from source hosted on GitHub, uses standard Node.js/Electron tooling with locked versions, and installs only project-owned dependencies; the variable-named package install via yarn is part of normal build workflow and not a supply-chain risk.
-
PKGBUILD:104
npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
PKGBUILD
1 offending line(s) highlighted# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=note-mark-git
_pkgname=NoteMark
pkgver=r11.d6a1863
_electronversion=28
_nodeversion=20
pkgrel=1
pkgdesc="A note-taking desktop app with out-of-the-box markdown support.Perfect for storing markdown notes on your desktop with ease."
arch=('any')
url="https://github.com/AbdulDevHub/NoteMark"
license=('MIT')
conflicts=("${pkgname%-git}")
provides=("${pkgname%-git}=${pkgver%.r*}")
depends=(
"electron${_electronversion}-bin"
)
makedepends=(
'npm'
'git'
'nvm'
'gendesk'
'jq'
'yarn'
)
source=(
"${pkgname%-git}.git::git+${url}.git"
"${pkgname%-git}.js"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
'562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
_get_project_dir() {
local d
while IFS= read -r d; do
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
}
pkgver() {
cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
_get_app_dir() {
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_get_electron_version() {
local _v
_v=$(jq -r '.. | (.electron? // empty) | strings' "$(_get_project_dir)/package.json" 2>/dev/null | head -1)
[[ -z "$_v" ]] && _v=$(grep -oE 'electron@[0-9.]+' "$(_get_project_dir)/pnpm-lock.yaml" 2>/dev/null | head -1 | sed 's/^electron@//')
[[ -z "$_v" ]] && _v=$(grep -oE 'electron@npm:[0-9.]+' "$(_get_project_dir)/yarn.lock" 2>/dev/null | head -1 | sed 's/^electron@npm://')
[[ -z "$_v" ]] && _v=$(jq -r '.packages["node_modules/electron"].version // empty' "$(_get_project_dir)/package-lock.json" 2>/dev/null | head -1)
[[ -z "$_v" ]] && _v=$(grep -oE 'electron: ?\[?"?npm:?[0-9.]+' "$(_get_project_dir)/bun.lock" 2>/dev/null | grep -oE '[0-9.]+' | head -1)
[[ -z "$_v" ]] && return 1
_v="$(printf '%s' "$_v" | sed 's/^[^0-9]*//')"
[[ "$_v" =~ ^[0-9] ]] || return 1
_v="${_v%%.*}"
(( ${_v} == _electronversion )) && echo -e "\033[1;32mElectron version: ${_v}\033[0m" || echo -e "\033[1;31mElectron version: ${_v} (expected ${_electronversion})\033[0m"
}
_set_electron_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
export ELECTRON_BUILDER_OFFLINE=true
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
}
_set_yarn_build_env() {
export HOME="${srcdir}/.home"
export XDG_CACHE_HOME="${HOME}/.cache"
export XDG_CONFIG_HOME="${HOME}/.config"
export XDG_DATA_HOME="${HOME}/.local/share"
export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
export YARN_NETWORK_CONCURRENCY=32
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
export COREPACK_HOME="${HOME}/.corepack"
export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
local _yarnver _yarnmajor=0
_yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"
_yarnmajor="${_yarnver%%.*}"
_yarnmajor="${_yarnmajor:-0}"
if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
export XDG_STATE_HOME="${HOME}/.local/state"
export YARN_ENABLE_GLOBAL_CACHE=false
export YARN_ENABLE_MIRROR=false
export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
export YARN_NODE_LINKER=node-modules
export YARN_NM_MODE=hardlinks-local
export YARN_ENABLE_TELEMETRY=false
export YARN_ENABLE_SCRIPTS=true
export YARN_HTTP_TIMEOUT=600000
export YARN_HTTP_RETRY=5
export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
local _yarnhome="${HOME}/.yarn/install"
mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
if [[ -n "${_yarnver}" ]]; then
npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
export PATH="${_yarnhome}/bin:${PATH}"
fi
else
export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
export YARN_LINK_FOLDER="${HOME}/.yarn/link"
export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
export YARN_NETWORK_TIMEOUT=600000
export YARN_CHILD_CONCURRENCY="$(nproc)"
export YARN_FROZEN_LOCKFILE=true
export YARN_IGNORE_ENGINES=true
export YARN_PRODUCTION=false
mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
export YARN_REGISTRY="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
fi
local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
_reg="${_reg%/}"
if [[ -f yarn.lock ]] && grep -q 'registry.yarnpkg.com' yarn.lock; then
sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
fi
}
prepare() {
cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
" "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
gendesk -q -f -n \
--pkgname="${pkgname%-git}" \
--pkgdesc="${pkgdesc}" \
--categories="Office" \
--name="${_pkgname}" \
--exec="${pkgname%-git} %U"
_ensure_local_nvm
_set_electron_build_env
_set_yarn_build_env
sed -i 's|\\\\|/|g' src/main/lib/index.ts
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
export NODE_ENV=development
yarn install
}
build() {
cd "$(_get_project_dir)"
_ensure_local_nvm
_set_electron_build_env
_set_yarn_build_env
export NODE_ENV=production
yarn run build
yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
install -Dm644 "$(_get_project_dir)/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
Changes since previous scan
--- PKGBUILD @ 2026-06-18 16:11+++ PKGBUILD @ 2026-11-06 06:11@@ -1,92 +1,164 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> pkgname=note-mark-git _pkgname=NoteMark-pkgver=r10.2d1d925+pkgver=r11.d6a1863 _electronversion=28-_nodeversion=18+_nodeversion=20 pkgrel=1-pkgdesc="A note-taking desktop app with out-of-the-box markdown support.Perfect for storing markdown notes on your desktop with ease.Use system-wide electron."+pkgdesc="A note-taking desktop app with out-of-the-box markdown support.Perfect for storing markdown notes on your desktop with ease." arch=('any') url="https://github.com/AbdulDevHub/NoteMark" license=('MIT') conflicts=("${pkgname%-git}") provides=("${pkgname%-git}=${pkgver%.r*}") depends=(- "electron${_electronversion}"+ "electron${_electronversion}-bin" ) makedepends=( 'npm' 'git' 'nvm' 'gendesk'- 'curl'+ 'jq' 'yarn' ) source=( "${pkgname%-git}.git::git+${url}.git"+ "${pkgname%-git}.js" "${pkgname%-git}.sh" ) sha256sums=('SKIP'- '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'+ 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')+_get_project_dir() {+ local d+ while IFS= read -r d; do+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')+} pkgver() {- cd "${srcdir}/${pkgname%-git}.git"- set -o pipefail- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"+ cd "$(_get_project_dir)"+ set -o pipefail+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)" } _ensure_local_nvm() {- local NVM_DIR="${srcdir}/.nvm"- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]- nvm install "${_nodeversion}"- nvm use "${_nodeversion}"+ local NVM_DIR="${srcdir}/.nvm"+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]+ nvm install "${_nodeversion}"+ nvm use "${_nodeversion}"+}+_get_app_dir() {+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done+}+_get_electron_version() {+ local _v+ _v=$(jq -r '.. | (.electron? // empty) | strings' "$(_get_project_dir)/package.json" 2>/dev/null | head -1)+ [[ -z "$_v" ]] && _v=$(grep -oE 'electron@[0-9.]+' "$(_get_project_dir)/pnpm-lock.yaml" 2>/dev/null | head -1 | sed 's/^electron@//')+ [[ -z "$_v" ]] && _v=$(grep -oE 'electron@npm:[0-9.]+' "$(_get_project_dir)/yarn.lock" 2>/dev/null | head -1 | sed 's/^electron@npm://')+ [[ -z "$_v" ]] && _v=$(jq -r '.packages["node_modules/electron"].version // empty' "$(_get_project_dir)/package-lock.json" 2>/dev/null | head -1)+ [[ -z "$_v" ]] && _v=$(grep -oE 'electron: ?\[?"?npm:?[0-9.]+' "$(_get_project_dir)/bun.lock" 2>/dev/null | grep -oE '[0-9.]+' | head -1)+ [[ -z "$_v" ]] && return 1+ _v="$(printf '%s' "$_v" | sed 's/^[^0-9]*//')"+ [[ "$_v" =~ ^[0-9] ]] || return 1+ _v="${_v%%.*}"+ (( ${_v} == _electronversion )) && echo -e "\033[1;32mElectron version: ${_v}\033[0m" || echo -e "\033[1;31mElectron version: ${_v} (expected ${_electronversion})\033[0m"+}+_set_electron_build_env() {+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1+ export ELECTRON_BUILDER_OFFLINE=true+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"+}+_set_yarn_build_env() {+ export HOME="${srcdir}/.home"+ export XDG_CACHE_HOME="${HOME}/.cache"+ export XDG_CONFIG_HOME="${HOME}/.config"+ export XDG_DATA_HOME="${HOME}/.local/share"+ export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"+ export YARN_NETWORK_CONCURRENCY=32+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"+ export COREPACK_HOME="${HOME}/.corepack"+ export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"+ local _yarnver _yarnmajor=0+ _yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"+ _yarnmajor="${_yarnver%%.*}"+ _yarnmajor="${_yarnmajor:-0}"+ if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then+ export XDG_STATE_HOME="${HOME}/.local/state"+ export YARN_ENABLE_GLOBAL_CACHE=false+ export YARN_ENABLE_MIRROR=false+ export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"+ export YARN_NODE_LINKER=node-modules+ export YARN_NM_MODE=hardlinks-local+ export YARN_ENABLE_TELEMETRY=false+ export YARN_ENABLE_SCRIPTS=true+ export YARN_HTTP_TIMEOUT=600000+ export YARN_HTTP_RETRY=5+ export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"+ local _yarnhome="${HOME}/.yarn/install"+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"+ if [[ -n "${_yarnver}" ]]; then+ npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"+ export PATH="${_yarnhome}/bin:${PATH}"+ fi+ else+ export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"+ export YARN_LINK_FOLDER="${HOME}/.yarn/link"+ export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"+ export YARN_NETWORK_TIMEOUT=600000+ export YARN_CHILD_CONCURRENCY="$(nproc)"+ export YARN_FROZEN_LOCKFILE=true+ export YARN_IGNORE_ENGINES=true+ export YARN_PRODUCTION=false+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"+ export YARN_REGISTRY="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"+ fi+ local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"+ _reg="${_reg%/}"+ if [[ -f yarn.lock ]] && grep -q 'registry.yarnpkg.com' yarn.lock; then+ sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock+ fi } prepare() {+ cd "$(_get_project_dir)"+ _get_electron_version sed -i -e " s/@electronversion@/${_electronversion}/g s/@appname@/${pkgname%-git}/g- s/@runname@/app.asar/g- s/@cfgdirname@/${pkgname%-git}/g- s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g- " "${srcdir}/${pkgname%-git}.sh"+ " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"+ gendesk -q -f -n \+ --pkgname="${pkgname%-git}" \+ --pkgdesc="${pkgdesc}" \+ --categories="Office" \+ --name="${_pkgname}" \+ --exec="${pkgname%-git} %U" _ensure_local_nvm- gendesk -q -f -n --pkgname="${pkgname%-git}" --pkgdesc="${pkgdesc}" --categories="Office" --name="${_pkgname}" --exec="${pkgname%-git} %U"- cd "${srcdir}/${pkgname%-git}.git"- export ELECTRON_SKIP_BINARY_DOWNLOAD=1- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"- HOME="${srcdir}/.electron-gyp"- mkdir -p "${srcdir}/.electron-gyp"- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then- {- echo -e '\n'- echo 'registry "https://registry.npmmirror.com"'- echo 'electron_mirror "https://registry.npmmirror.com/-/binary/electron/"'- echo 'electron_builder_binaries_mirror "https://registry.npmmirror.com/-/binary/electron-builder-binaries/"'- echo "cacheFolder "${srcdir}"/.yarn/cache"- echo "pluginsFolder "${srcdir}"/.yarn/plugins"- echo "globalFolder "${srcdir}"/.yarn/global"- echo 'useHardlinks true'- #echo 'buildFromSource true'- echo 'linkWorkspacePackages true'- echo 'fetchRetries 3'- echo 'fetchRetryTimeout 10000'- } >> .yarnrc- find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g" {} +- fi+ _set_electron_build_env+ _set_yarn_build_env sed -i 's|\\\\|/|g' src/main/lib/index.ts- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json- NODE_ENV=development yarn install --cache-folder "${srcdir}/.yarn_cache"+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json+ export NODE_ENV=development+ yarn install } build() {- cd "${srcdir}/${pkgname%-git}.git"- local electronDist="/usr/lib/electron${_electronversion}"- NODE_ENV=production yarn run build- NODE_ENV=production yarn electron-builder --linux dir -c.electronDist="${electronDist}" --config electron-builder.yml+ cd "$(_get_project_dir)"+ _ensure_local_nvm+ _set_electron_build_env+ _set_yarn_build_env+ export NODE_ENV=production+ yarn run build+ yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml+ rm -rf "$(_get_app_dir)/resources/default_app.asar" } package() { install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"- install -Dm644 "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"- cp -Pr --no-preserve=ownership "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar.unpacked "${pkgdir}/usr/lib/${pkgname%-git}"- install -Dm644 "${srcdir}/${pkgname%-git}.git/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"- install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"- install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"+ install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"+ install -Dm644 "$(_get_project_dir)/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}" }+Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-06 06:11:22 | Low | 1 |
| 2026-06-18 16:11:54 | Clean | 0 |