notion-app-electron

MEDIUM

maintainer AsukaMinato 29 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

Downloads a prebuilt Windows .exe installer from a non-whitelisted host (notion-static.com), which is unpacked and repackaged; while the source is from the official project, the use of an unverifiable binary artifact from a non-standard domain creates a supply-chain risk if that host were compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 https://desktop-release.notion-static.com/Notion%20Setup%20${pkgver}.exe

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): Downloads a prebuilt Windows .exe installer from a non-whitelisted host (notion-static.com), which is unpacked and repackaged; while the source is from the official project, the use of an unverifiable binary artifact from a non-standard domain creates a supply-chain risk if that host were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Asuka Minato <i at asukaminato dot eu dot org>
    
      2# Maintainer: Kid <hi at xuann dot wang>
    
      3# Maintainer: Mateus Honorato <mateush.honorato@gmail.com>
    
      4# Contributor: Jaime Martínez Rincón <jaime@jamezrin.name>
    
      5
    
      6pkgname=notion-app-electron
    
      7pkgver=7.33.0
    
      8_bettersqlite3ver=12.9.0
    
      9_bufferutilver=4.0.9
    
      10_elecronver=145 # whenever update the bettersqlite, update this one by one to try the proper version.
    
      11pkgrel=1
    
      12pkgdesc="Your connected workspace for wiki, docs & projects"
    
      13arch=(x86_64)
    
      14url=https://www.notion.so/desktop
    
      15license=(custom)
    
      16depends=(
    
bash
    
gcc-libs
    
glibc
    
hicolor-icon-theme
    
electron41
    
      22)
    
      23makedepends=(
    
p7zip
    
asar
    
ast-grep
    
      27)
    
      28install=.install
    
      29
    
      30source=(
    
https://desktop-release.notion-static.com/Notion%20Setup%20${pkgver}.exe
    
https://github.com/WiseLibs/better-sqlite3/releases/download/v${_bettersqlite3ver}/better-sqlite3-v${_bettersqlite3ver}-electron-v${_elecronver}-linux-x64.tar.gz
    
https://github.com/websockets/bufferutil/releases/download/v${_bufferutilver}/v${_bufferutilver}-linux-x64.tar
    
notion-app
    
notion.desktop
    
notion.png
    
      37)
    
      38sha256sums=('caa9cccb26e264244cde0c6492d0dee4f4b9d09ce3ca495152a0cc2e9f3fb4ae'
    
          '59d9e3beed32ff516fa79fc09bfb819a7abd84d077a77abfc68d85a6d79ac757'
    
          '2139aae79c5a4fd4d07467bd9b7872ea109483aa43b3dfd6c8d3725ccba009be'
    
          '916f75f612d353651d3d04a414c29d157521a06765683742a66279acac904744'
    
          '19a5f973f1e9291081aa05512e07c61447e8c30e1a43dd22d0cc1090837d1e19'
    
          'da801d659d8916320e0d76c8c62154e97a1d44f71762f2a18d1c8c185624d5be')
    
      44
    
      45options=(!emptydirs)
    
      46
    
      47prepare() {
    
# extracting app.asar from installer with 7z and ignoring errors
    
7z x "./Notion%20Setup%20${pkgver}.exe" "\$PLUGINSDIR/app-64.7z" -y -bse0 -bso0 || true
    
7z x "./\$PLUGINSDIR/app-64.7z" "resources/app.asar" "resources/app.asar.unpacked" -y -bse0 -bso0 || true
    
rm "./Notion%20Setup%20${pkgver}.exe"
    
rm "./\$PLUGINSDIR/app-64.7z"
    
# extracting resources from app.asar
    
asar e "$srcdir/resources/app.asar" "$srcdir/asar_patched"
    
# replacing better_sqlite3 release in the patched resources
    
install -vDm644 "$srcdir/build/Release/better_sqlite3.node" -t "$srcdir/asar_patched/node_modules/better-sqlite3/build/Release/"
    
# replacing bufferutil release in the patched resources
    
install -vDm644 "$srcdir/linux-x64/bufferutil.node" "$srcdir/asar_patched/node_modules/bufferutil/build/Release/bufferutil.node"
    
# removing some unnecessary files (keeping them in this version to see if it improves stability)
    
# rm "$srcdir/asar_patched/node_modules/node-mac-window" -r
    
# rm "$srcdir/asar_patched/node_modules/better-sqlite3/build/Release/test_extension.node"
    
# adding tray icon to the unpacked resources
    
install -vDm644 "$srcdir/notion.png" "$srcdir/asar_patched/.webpack/main/trayIcon.png"
    
local index_js="$srcdir/asar_patched/.webpack/main/index.js"
    
local sg_flags=(--lang javascript -U)
    
sg_patch() {
    
ast-grep run "${sg_flags[@]}" -p "$1" -r "$2" "$index_js" >/dev/null 2>&1
    
}
    
sg_patch_select() {
    
ast-grep run "${sg_flags[@]}" --selector "$1" -p "$2" -r "$3" "$index_js" >/dev/null 2>&1
    
}
    
# Linux desktop patches. Match on behavior anchors instead of exact minified variable names.
    
sg_patch \
    
'this.tray.on("click",()=>{this.onClick()})' \
    
'this.tray.setContextMenu(this.trayMenu),this.tray.on("click",()=>{this.onClick()})'
    
sg_patch_select method_definition \
    
'class X { getIcon(){ $$$BODY } }' \
    
'getIcon(){return require("path").resolve(__dirname,"trayIcon.png");}'
    
sg_patch \
    
'$S.setUserAgent(`${$S.getUserAgent()} WantsServiceWorker`)' \
    
'$S.setUserAgent(`${$S.getUserAgent().replace("Linux", "Windows")} WantsServiceWorker`)'
    
sg_patch \
    
'if("darwin"===process.platform)$MAC;else if("win32"===process.platform){const $UNINSTALL=$ARGS=>$ARGS.find($ARG=>"--uninstall"===$ARG);$$$B}' \
    
'if("darwin"===process.platform)$MAC;else if("linux"===process.platform){const $UNINSTALL=$ARGS=>$ARGS.find($ARG=>"--uninstall"===$ARG);$$$B}'
    
# System Electron includes app.asar in argv; do not treat it as a Markdown file.
    
sg_patch \
    
'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&!$ARG.startsWith(`${$CONFIG.default.protocol}:`)&&$EXT.length>0&&".exe"!==$EXT}' \
    
'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&!$ARG.startsWith(`${$CONFIG.default.protocol}:`)&&$EXT.length>0&&".exe"!==$EXT&&".asar"!==$EXT}'
    
sg_patch \
    
'($$$PRE,function(){$$$INIT}(),0)' \
    
'($$$PRE,function(){$$$INIT}())'
    
sg_patch_select ternary_expression \
    
'"win32"===process.platform?function($E,$T){$$$A}($E,$T):$ALT' \
    
'"linux"===process.platform?function($E,$T){$$$A}($E,$T):$ALT'
    
# this can disable app menu when the options won't work. disbled in the current version because it's working now, but it's here for future reference
    
# sed -i 's|Menu.setApplicationMenu(p(e))|Menu.setApplicationMenu(null)|g' "$srcdir/asar_patched/.webpack/main/index.js"
    
# repacking asar with all the patches
    
asar p "$srcdir/asar_patched" "$srcdir/app.asar" --unpack *.node
    
      99}
    
      100
    
      101package() {
    
local usr="$pkgdir/usr"
    
local share="$usr/share"
    
local lib="$usr/lib/notion-app"
    
      105
    
install -d "$lib"
    
cp "$srcdir/app.asar" "$lib"
    
cp "$srcdir/app.asar.unpacked" "$lib" -r
    
install -vDm644 "$srcdir/asar_patched/package.json" "$lib/package.json"
    
install -vDm755 notion-app -t "$usr/bin"
    
install -vDm644 "$srcdir/notion.desktop" -t "$share/applications"
    
install -vDm644 "$srcdir/notion.png" -t "$share/icons/hicolor/256x256/apps"
    
      113}
    
      114

Changes since previous scan

--- PKGBUILD @ 2026-09-16 00:03
+++ PKGBUILD @ 2026-09-17 00:27
@@ -4,7 +4,7 @@
 # Contributor: Jaime Martínez Rincón <jaime@jamezrin.name>
 
 pkgname=notion-app-electron
-pkgver=7.32.1
+pkgver=7.33.0
 _bettersqlite3ver=12.9.0
 _bufferutilver=4.0.9
 _elecronver=145 # whenever update the bettersqlite, update this one by one to try the proper version.
@@ -35,7 +35,7 @@
 	notion.desktop
 	notion.png
 )
-sha256sums=('36650c60918aabd4c0b856b91c924ecff4b541518d8c1bd1506db677a8e42d8a'
+sha256sums=('caa9cccb26e264244cde0c6492d0dee4f4b9d09ce3ca495152a0cc2e9f3fb4ae'
             '59d9e3beed32ff516fa79fc09bfb819a7abd84d077a77abfc68d85a6d79ac757'
             '2139aae79c5a4fd4d07467bd9b7872ea109483aa43b3dfd6c8d3725ccba009be'
             '916f75f612d353651d3d04a414c29d157521a06765683742a66279acac904744'

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 11:22:36	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 17:21:08	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 03:15:31	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 11:53:08	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2