notion-app-electron
MEDIUM
maintainer AsukaMinato
29 votes
scanned 2026-11-02 00:26:00.633185
Why flagged
The package downloads a prebuilt Windows .exe installer from a non-standard host (notion-static.com), which is unpacked and repackaged; while the modifications appear legitimate, the unverifiable origin of the binary artifact creates a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
https://desktop-release.notion-static.com/Notion%20Setup%20${pkgver}.exe
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt Windows .exe installer from a non-standard host (notion-static.com), which is unpacked and repackaged; while the modifications appear legitimate, the unverifiable origin of the binary artifact creates a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Asuka Minato <i at asukaminato dot eu dot org>
2
# Maintainer: Kid <hi at xuann dot wang>
3
# Maintainer: Mateus Honorato <mateush.honorato@gmail.com>
4
# Contributor: Jaime Martínez Rincón <jaime@jamezrin.name>
5
6
pkgname=notion-app-electron
7
pkgver=7.41.0
8
_bettersqlite3ver=13.0.1
9
_bufferutilver=4.0.9
10
_pipewirever=1.1.0
11
pkgrel=1
12
pkgdesc="Your connected workspace for wiki, docs & projects"
13
arch=(x86_64)
14
url=https://www.notion.so/desktop
15
license=(custom)
16
depends=(
17
bash
18
glibc
19
hicolor-icon-theme
20
electron43
21
libstdc++
22
libpipewire
23
libgcc
24
)
25
makedepends=(
26
p7zip
27
asar
28
ast-grep
29
)
30
install=.install
31
32
source=(
33
https://desktop-release.notion-static.com/Notion%20Setup%20${pkgver}.exe
34
https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-${_bettersqlite3ver}.tgz
35
https://github.com/websockets/bufferutil/releases/download/v${_bufferutilver}/v${_bufferutilver}-linux-x64.tar
36
https://registry.npmjs.org/node-pipewire/-/node-pipewire-${_pipewirever}.tgz
37
node-pipewire-${_pipewirever}-napi-v6-linux-x64.tar.gz::https://github.com/kakxem/node-pipewire/releases/download/${_pipewirever}/napi-v6-linux-x64.tar.gz
38
notion-app
39
notion.desktop
40
notion.png
41
)
42
sha256sums=('23e9b0f45c30e302dad47c8ea6620eb3d49aff5dcc23a1f90f50c357e4508e97'
43
'92935ff8280f933aff78f87e04eb718a21af003aec4e5bd0076f287aa1709da4'
44
'2139aae79c5a4fd4d07467bd9b7872ea109483aa43b3dfd6c8d3725ccba009be'
45
'ed7425c2f287df8e192656f89b5c6645f67837aaaba64692e493dc8e8e0d55fe'
46
'ec6ea34a3c1ce1cf71bd1c88fe70eb11f26330d33a44e7051f2b37a53e008200'
47
'5684fbb75a9b15dab6cf4ded317ccaf899d2b03ce7d7cf0090ebcf9298089a1c'
48
'19a5f973f1e9291081aa05512e07c61447e8c30e1a43dd22d0cc1090837d1e19'
49
'da801d659d8916320e0d76c8c62154e97a1d44f71762f2a18d1c8c185624d5be')
50
51
options=(!emptydirs)
52
noextract=(
53
better-sqlite3-${_bettersqlite3ver}.tgz
54
node-pipewire-${_pipewirever}.tgz
55
node-pipewire-${_pipewirever}-napi-v6-linux-x64.tar.gz
56
)
57
58
prepare() {
59
# extracting app.asar from installer with 7z and ignoring errors
60
7z x "./Notion%20Setup%20${pkgver}.exe" "\$PLUGINSDIR/app-64.7z" -y -bse0 -bso0 || true
61
7z x "./\$PLUGINSDIR/app-64.7z" "resources/app.asar" "resources/app.asar.unpacked" -y -bse0 -bso0 || true
62
rm "./Notion%20Setup%20${pkgver}.exe"
63
rm "./\$PLUGINSDIR/app-64.7z"
64
# extracting resources from app.asar
65
# Discard previous extraction and unpacked output so removed files cannot survive a rebuild.
66
rm -rf "$srcdir/asar_patched" "$srcdir/app.asar.unpacked"
67
asar e "$srcdir/resources/app.asar" "$srcdir/asar_patched"
68
# Match Notion's JS version using the upstream Linux Node-API prebuild.
69
bsdtar -xOf "$srcdir/better-sqlite3-${_bettersqlite3ver}.tgz" package/prebuilds/linux-x64.node \
70
> "$srcdir/asar_patched/node_modules/better-sqlite3/build/Release/better_sqlite3.node"
71
# replacing bufferutil release in the patched resources
72
install -vDm644 "$srcdir/linux-x64/bufferutil.node" "$srcdir/asar_patched/node_modules/bufferutil/build/Release/bufferutil.node"
73
# Remove Windows/macOS-only resources from the Windows installer.
74
rm -f \
75
"$srcdir/asar_patched/.webpack/main/native_modules/build/Release/winregistry.node" \
76
"$srcdir/asar_patched/.webpack/main/native_modules/adjust_get_current_system_volume_vista_plus.exe" \
77
"$srcdir/asar_patched/node_modules/@notionhq/desktop-native/build/Release/win_utils.node" \
78
"$srcdir/asar_patched/node_modules/better-sqlite3/build/Release/test_extension.node"
79
rm -rf \
80
"$srcdir/asar_patched/node_modules/cf-prefs" \
81
"$srcdir/asar_patched/node_modules/node-mac-window"
82
# The Windows progress-bar DLL cannot load on Linux. Its Linux prebuild uses
83
# GTK4, which conflicts with system Electron's linked GTK3; retain the existing fallback.
84
rm -f "$srcdir/asar_patched/node_modules/@jasonscheirer/native-progress-bar/build/Release/progress_bar.node"
85
# Notion's desktop-native Linux implementation uses node-pipewire for audio detection.
86
local pipewire_dir="$srcdir/asar_patched/node_modules/node-pipewire"
87
install -d "$pipewire_dir/dist/binding/napi-v6"
88
bsdtar -xf "$srcdir/node-pipewire-${_pipewirever}.tgz" -C "$pipewire_dir" \
89
--strip-components 1 package/package.json package/LICENSE package/dist/index.js
90
bsdtar -xOf "$srcdir/node-pipewire-${_pipewirever}-napi-v6-linux-x64.tar.gz" \
91
napi-v6/index.node > "$pipewire_dir/dist/binding/napi-v6/index.node"
92
# adding tray icon to the unpacked resources
93
install -vDm644 "$srcdir/notion.png" "$srcdir/asar_patched/.webpack/main/trayIcon.png"
94
local index_js="$srcdir/asar_patched/.webpack/main/index.js"
95
local sg_flags=(--lang javascript -U)
96
sg_patch() {
97
ast-grep run "${sg_flags[@]}" -p "$1" -r "$2" "$index_js" >/dev/null 2>&1
98
}
99
sg_patch_select() {
100
ast-grep run "${sg_flags[@]}" --selector "$1" -p "$2" -r "$3" "$index_js" >/dev/null 2>&1
101
}
102
# Linux desktop patches. Match on behavior anchors instead of exact minified variable names.
103
sg_patch \
104
'this.tray.on("click",()=>{this.onClick()})' \
105
'this.tray.setContextMenu(this.trayMenu),this.tray.on("click",()=>{this.onClick()})'
106
sg_patch_select method_definition \
107
'class X { getIcon(){ $$$BODY } }' \
108
'getIcon(){return require("path").resolve(__dirname,"trayIcon.png");}'
109
sg_patch \
110
'$S.setUserAgent(`${$S.getUserAgent()} WantsServiceWorker`)' \
111
'$S.setUserAgent(`${$S.getUserAgent().replace("Linux", "Windows")} WantsServiceWorker`)'
112
sg_patch \
113
'if("darwin"===process.platform)$MAC;else if("win32"===process.platform){const $UNINSTALL=$ARGS=>$ARGS.find($ARG=>"--uninstall"===$ARG);$$$B}' \
114
'if("darwin"===process.platform)$MAC;else if("linux"===process.platform){const $UNINSTALL=$ARGS=>$ARGS.find($ARG=>"--uninstall"===$ARG);$$$B}'
115
# System Electron includes app.asar in argv; do not treat it as a Markdown file.
116
sg_patch \
117
'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&void 0===$SCHEME($ARG)&&$EXT.length>0&&".exe"!==$EXT}' \
118
'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&void 0===$SCHEME($ARG)&&$EXT.length>0&&".exe"!==$EXT&&".asar"!==$EXT}'
119
sg_patch \
120
'($$$PRE,function(){$$$INIT}(),0)' \
121
'($$$PRE,function(){$$$INIT}())'
122
sg_patch_select ternary_expression \
123
'"win32"===process.platform?function($E,$T){$$$A}($E,$T):$ALT' \
124
'"linux"===process.platform?function($E,$T){$$$A}($E,$T):$ALT'
125
# this can disable app menu when the options won't work. disbled in the current version because it's working now, but it's here for future reference
126
# sed -i 's|Menu.setApplicationMenu(p(e))|Menu.setApplicationMenu(null)|g' "$srcdir/asar_patched/.webpack/main/index.js"
127
# repacking asar with all the patches
128
asar p "$srcdir/asar_patched" "$srcdir/app.asar" --unpack '*.node'
129
}
130
131
package() {
132
local usr="$pkgdir/usr"
133
local share="$usr/share"
134
local lib="$usr/lib/notion-app"
135
136
install -d "$lib"
137
cp "$srcdir/app.asar" "$lib"
138
cp "$srcdir/app.asar.unpacked" "$lib" -r
139
install -vDm644 "$srcdir/asar_patched/package.json" "$lib/package.json"
140
install -vDm755 notion-app -t "$usr/bin"
141
install -vDm644 "$srcdir/notion.desktop" -t "$share/applications"
142
install -vDm644 "$srcdir/notion.png" -t "$share/icons/hicolor/256x256/apps"
143
}
144
Changes since previous scan
--- PKGBUILD @ 2026-10-29 00:13+++ PKGBUILD @ 2026-11-02 00:26@@ -4,11 +4,11 @@ # Contributor: Jaime Martínez Rincón <jaime@jamezrin.name> pkgname=notion-app-electron-pkgver=7.40.0+pkgver=7.41.0 _bettersqlite3ver=13.0.1 _bufferutilver=4.0.9 _pipewirever=1.1.0-pkgrel=2+pkgrel=1 pkgdesc="Your connected workspace for wiki, docs & projects" arch=(x86_64) url=https://www.notion.so/desktop@@ -39,7 +39,7 @@ notion.desktop notion.png )-sha256sums=('c6cc1b5cdb016bf9f9445906ea6a499c8f46a72c568991ea36acf6cc823b7bfe'+sha256sums=('23e9b0f45c30e302dad47c8ea6620eb3d49aff5dcc23a1f90f50c357e4508e97' '92935ff8280f933aff78f87e04eb718a21af003aec4e5bd0076f287aa1709da4' '2139aae79c5a4fd4d07467bd9b7872ea109483aa43b3dfd6c8d3725ccba009be' 'ed7425c2f287df8e192656f89b5c6645f67837aaaba64692e493dc8e8e0d55fe'@@ -114,8 +114,8 @@ 'if("darwin"===process.platform)$MAC;else if("linux"===process.platform){const $UNINSTALL=$ARGS=>$ARGS.find($ARG=>"--uninstall"===$ARG);$$$B}' # System Electron includes app.asar in argv; do not treat it as a Markdown file. sg_patch \- 'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&!$ARG.startsWith(`${$CONFIG.default.protocol}:`)&&$EXT.length>0&&".exe"!==$EXT}' \- 'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&!$ARG.startsWith(`${$CONFIG.default.protocol}:`)&&$EXT.length>0&&".exe"!==$EXT&&".asar"!==$EXT}'+ 'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&void 0===$SCHEME($ARG)&&$EXT.length>0&&".exe"!==$EXT}' \+ 'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&void 0===$SCHEME($ARG)&&$EXT.length>0&&".exe"!==$EXT&&".asar"!==$EXT}' sg_patch \ '($$$PRE,function(){$$$INIT}(),0)' \ '($$$PRE,function(){$$$INIT}())'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-02 00:26:00 | Medium | 2 |
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 09:52:05 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 09:47:05 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 09:31:11 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 01:23:43 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |