noteey

MEDIUM

maintainer AsukaMinato 0 votes scanned 2026-09-06 02:02:01.866548

View on AUR

Why flagged

The package extracts and modifies code from a prebuilt Windows .exe installer hosted on GitHub, which is not the project's official release channel, creating a supply-chain risk if the source were swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package extracts and modifies code from a prebuilt Windows .exe installer hosted on GitHub, which is not the project's official release channel, creating a supply-chain risk if the source were swapped.

PKGBUILD

      1# Maintainer: minato <i at asukaminato dot eu dot org>
    
      2
    
      3pkgname=noteey
    
      4pkgver=1.62.0
    
      5pkgrel=1
    
      6pkgdesc='Visual note-taking app for organizing complex knowledge and ideas'
    
      7arch=('x86_64')
    
      8url='https://noteey.com/'
    
      9license=('MIT')
    
      10depends=(
    
      11  'electron39'
    
      12  'hicolor-icon-theme'
    
      13)
    
      14makedepends=(
    
      15  'asar'
    
      16  'p7zip'
    
      17)
    
      18provides=('noteey')
    
      19conflicts=('noteey')
    
      20options=('!strip')
    
      21source=(
    
      22  "Noteey-Setup-${pkgver}.exe::https://github.com/andyyoungm/muenzo/releases/download/v${pkgver}/Noteey-Setup-${pkgver}.exe"
    
      23  'noteey'
    
      24  'noteey.desktop'
    
      25)
    
      26sha256sums=('970bd0c0ace8dba21335f88fc71841dee8e5ca748ea37ba3dfe3b8450d3b1546'
    
      27            '908962ed7ba279d99be249507b75b1afd7b4cf72b80b60313b4c1d139e425ca3'
    
      28            '13d71ff65bef1e87d0db3650d84292c5c9ec58e2d94723415717df602dff5975')
    
      29
    
      30prepare() {
    
      31  rm -rf "$srcdir/extracted" "$srcdir/app"
    
      32  mkdir -p "$srcdir/extracted" "$srcdir/app"
    
      33
    
      34  7z x "$srcdir/Noteey-Setup-${pkgver}.exe" \
    
      35    "-o$srcdir/extracted" \
    
      36    '$PLUGINSDIR/app-64.7z'
    
      37  7z x "$srcdir/extracted/\$PLUGINSDIR/app-64.7z" \
    
      38    "-o$srcdir/extracted" \
    
      39    'resources/app.asar' \
    
      40    'resources/node_modules/*'
    
      41
    
      42  asar extract "$srcdir/extracted/resources/app.asar" "$srcdir/app"
    
      43  cp -a "$srcdir/extracted/resources/node_modules" "$srcdir/app/node_modules"
    
      44
    
      45  local main_js="$srcdir/app/index.js"
    
      46  sed -i \
    
      47    -e '1aObject.defineProperty(app, "isPackaged", { get: () => true });' \
    
      48    -e '2aif (process.platform === "linux") app.setDesktopName("noteey.desktop");' \
    
      49    -e "s/    autoUpdater.checkForUpdates();/    sendMessageUpdate('update-not-available');/" \
    
      50    -e "s/    autoUpdater.downloadUpdate();/    sendMessageUpdate('update-not-available');/" \
    
      51    -e "s/    autoUpdater.quitAndInstall();/    sendMessageUpdate('update-not-available');/" \
    
      52    -e 's/  app.setAsDefaultProtocolClient/  process.platform !== "linux" \&\& app.setAsDefaultProtocolClient/' \
    
      53    "$main_js"
    
      54  grep -Fqx 'Object.defineProperty(app, "isPackaged", { get: () => true });' "$main_js"
    
      55  grep -Fqx 'if (process.platform === "linux") app.setDesktopName("noteey.desktop");' "$main_js"
    
      56  ! grep -Eq '^    autoUpdater\.(checkForUpdates|downloadUpdate|quitAndInstall)' "$main_js"
    
      57  ! grep -Eq '^  app\.setAsDefaultProtocolClient' "$main_js"
    
      58}
    
      59
    
      60package() {
    
      61  install -dm755 "$pkgdir/usr/lib/noteey"
    
      62  cp -a --no-preserve=ownership "$srcdir/app" "$pkgdir/usr/lib/noteey/app"
    
      63
    
      64  install -Dm755 noteey "$pkgdir/usr/bin/noteey"
    
      65  install -Dm644 noteey.desktop \
    
      66    "$pkgdir/usr/share/applications/noteey.desktop"
    
      67  install -Dm644 "$srcdir/app/logo.png" \
    
      68    "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/noteey.png"
    
      69}
    
      70

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-06 02:02:01	Medium	2