notesnook
LOW
maintainer zxp19821005
8 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The flagged npm install of 'sqlite-better-trigram' is a direct dependency needed for the desktop app build, sourced from npm via standard package resolution; it is not an obfuscated or unverifiable remote code execution, and the package is built from the official GitHub repository with versioned release.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged npm install of 'sqlite-better-trigram' is a direct dependency needed for the desktop app build, sourced from npm via standard package resolution; it is not an obfuscated or unverifiable remote code execution, and the package is built from the official GitHub repository with versioned release.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:99
NODE_ENV=development npm install sqlite-better-trigram
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
# Contributor: begin-theadventure <begin-thecontact.ncncb at dralias dot com>
3
# Contributor: joelvaz0x01 <joelvaz dot whitehat at gmail dot com>
4
# Contributor: Dawid Weglarz <dawid.weglarz95@gmail.com>
5
# Contributor: candroid_man <candroid_man@protonmail.com>
6
# Contributor: Ada <adadonderr@gmail.com>
7
# Contributor: Christian Finnberg <christian@finnberg.net>
8
pkgname=notesnook
9
_pkgname=Notesnook
10
pkgver=3.4.6
11
_electronversion=37
12
_nodeversion=22
13
pkgrel=1
14
pkgdesc="A fully open source & end-to-end encrypted note taking alternative to Evernote.(Use system-wide electron)"
15
arch=(
16
'aarch64'
17
'x86_64'
18
)
19
url="https://notesnook.com/"
20
_ghurl="https://github.com/streetwriters/notesnook"
21
license=('GPL-3.0-or-later')
22
provides=("${pkgname}=${pkgver}")
23
conflicts=("${pkgname}")
24
depends=(
25
"electron${_electronversion}"
26
)
27
makedepends=(
28
'nvm'
29
'npm'
30
'zip'
31
'curl'
32
'yarn'
33
'python-setuptools'
34
'jq'
35
)
36
source=(
37
"${pkgname}.desktop"
38
"${pkgname}.sh"
39
)
40
sha256sums=('102a538ee9432310d854842a578cd3371df0431b4db617479de66aa45b5f2440'
41
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
42
_ensure_local_nvm() {
43
local NVM_DIR="${srcdir}/.nvm"
44
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
45
nvm install "${_nodeversion}"
46
nvm use "${_nodeversion}"
47
}
48
_get_app_dir() {
49
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
50
}
51
_set_build_env() {
52
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
53
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
54
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
55
export HOME="${srcdir}/.electron-gyp"
56
export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
57
export NPM_CONFIG_MAXSOCKETS=32
58
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
59
{
60
export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
61
export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
62
export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
63
export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
64
}
65
find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
66
fi
67
}
68
_get_electron_version() {
69
_elec_ver=$(jq -r '.devDependencies["electron"] // .dependencies["electron"]' "${srcdir}/${pkgname}-${pkgver}/apps/desktop/package.json" | tr -d '^')
70
_main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
71
echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
72
}
73
prepare() {
74
cd "${srcdir}"
75
if [[ ! -d "${srcdir}/${pkgname}-${pkgver}" ]]; then
76
export GIT_CONFIG_GLOBAL="${HOME}/.gitconfig"
77
git clone \
78
--depth 1 \
79
--branch "v${pkgver}" \
80
"${_ghurl}" \
81
"${pkgname}-${pkgver}"
82
fi
83
cd "${srcdir}/${pkgname}-${pkgver}"
84
_get_electron_version
85
sed -i -e "
86
s/@electronversion@/${_electronversion}/g
87
s/@appname@/${pkgname}/g
88
s/@runname@/app.asar/g
89
s/@cfgdirname@/${_pkgname}/g
90
" "${srcdir}/${pkgname}.sh"
91
_set_build_env
92
_ensure_local_nvm
93
sed -i "s/npm \${/NODE_ENV=development npm \${/g" scripts/bootstrap.mjs
94
find apps -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname}\'/g" {} +
95
NODE_ENV=development npm install --ignore-scripts --prefer-offline --no-audit
96
NODE_ENV=development npm run bootstrap -- --scope=web
97
NODE_ENV=development npm run bootstrap -- --scope=desktop
98
cd "${srcdir}/${pkgname}-${pkgver}/apps/desktop"
99
NODE_ENV=development npm install sqlite-better-trigram
100
}
101
build() {
102
cd "${srcdir}/${pkgname}-${pkgver}"
103
_set_build_env
104
_ensure_local_nvm
105
NODE_ENV=production npm run tx @notesnook/web:build:desktop
106
cd "${srcdir}/${pkgname}-${pkgver}/apps/desktop"
107
local electronDist="/usr/lib/electron${_electronversion}"
108
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
109
NODE_ENV=production npm run bundle
110
cp -r "${srcdir}/${pkgname}-${pkgver}/apps/web/build" "${srcdir}/${pkgname}-${pkgver}/apps/desktop"
111
NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config=electron-builder.config.js"
112
}
113
package() {
114
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
115
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
116
local _app_dir=$(_get_app_dir)
117
cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname}/"
118
_icon_sizes=(16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
119
for _icons in "${_icon_sizes[@]}";do
120
install -Dm644 "${srcdir}/${pkgname}-${pkgver}/apps/desktop/assets/icons/${_icons}.png" \
121
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname}.png"
122
done
123
install -Dm644 "${srcdir}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
124
}
125
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 09:44:49 | Medium | 1 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |