notion-app-electron
maintainer AsukaMinato
· 29 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt Notion executable installer from a non-standard host (notion-static.com), which is unverifiable and could be swapped with malicious content, constituting a supply-chain risk.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:31
https://desktop-release.notion-static.com/Notion%20Setup%20${pkgver}.exe
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt Notion executable installer from a non-standard host (notion-static.com), which is unverifiable and could be swapped with malicious content, constituting a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Asuka Minato <i at asukaminato dot eu dot org>
2
# Maintainer: Kid <hi at xuann dot wang>
3
# Maintainer: Mateus Honorato <mateush.honorato@gmail.com>
4
# Contributor: Jaime Martínez Rincón <jaime@jamezrin.name>
5
6
pkgname=notion-app-electron
7
pkgver=7.27.0
8
_bettersqlite3ver=12.9.0
9
_bufferutilver=4.0.9
10
_elecronver=145 # whenever update the bettersqlite, update this one by one to try the proper version.
11
pkgrel=1
12
pkgdesc="Your connected workspace for wiki, docs & projects"
13
arch=(x86_64)
14
url=https://www.notion.so/desktop
15
license=(custom)
16
depends=(
17
bash
18
gcc-libs
19
glibc
20
hicolor-icon-theme
21
electron41
22
)
23
makedepends=(
24
p7zip
25
asar
26
ast-grep
27
)
28
install=.install
29
30
source=(
31
https://desktop-release.notion-static.com/Notion%20Setup%20${pkgver}.exe
32
https://github.com/WiseLibs/better-sqlite3/releases/download/v${_bettersqlite3ver}/better-sqlite3-v${_bettersqlite3ver}-electron-v${_elecronver}-linux-x64.tar.gz
33
https://github.com/websockets/bufferutil/releases/download/v${_bufferutilver}/v${_bufferutilver}-linux-x64.tar
34
notion-app
35
notion.desktop
36
notion.png
37
)
38
sha256sums=('5815ce1364f94f9832f375cb3941fc49fce8b45a84f7096b5fa99771d5693aab'
39
'59d9e3beed32ff516fa79fc09bfb819a7abd84d077a77abfc68d85a6d79ac757'
40
'2139aae79c5a4fd4d07467bd9b7872ea109483aa43b3dfd6c8d3725ccba009be'
41
'916f75f612d353651d3d04a414c29d157521a06765683742a66279acac904744'
42
'19a5f973f1e9291081aa05512e07c61447e8c30e1a43dd22d0cc1090837d1e19'
43
'da801d659d8916320e0d76c8c62154e97a1d44f71762f2a18d1c8c185624d5be')
44
45
options=(!emptydirs)
46
47
prepare() {
48
# extracting app.asar from installer with 7z and ignoring errors
49
7z x "./Notion%20Setup%20${pkgver}.exe" "\$PLUGINSDIR/app-64.7z" -y -bse0 -bso0 || true
50
7z x "./\$PLUGINSDIR/app-64.7z" "resources/app.asar" "resources/app.asar.unpacked" -y -bse0 -bso0 || true
51
rm "./Notion%20Setup%20${pkgver}.exe"
52
rm "./\$PLUGINSDIR/app-64.7z"
53
# extracting resources from app.asar
54
asar e "$srcdir/resources/app.asar" "$srcdir/asar_patched"
55
# replacing better_sqlite3 release in the patched resources
56
install -vDm644 "$srcdir/build/Release/better_sqlite3.node" -t "$srcdir/asar_patched/node_modules/better-sqlite3/build/Release/"
57
# replacing bufferutil release in the patched resources
58
install -vDm644 "$srcdir/linux-x64/bufferutil.node" "$srcdir/asar_patched/node_modules/bufferutil/build/Release/bufferutil.node"
59
# removing some unnecessary files (keeping them in this version to see if it improves stability)
60
# rm "$srcdir/asar_patched/node_modules/node-mac-window" -r
61
# rm "$srcdir/asar_patched/node_modules/better-sqlite3/build/Release/test_extension.node"
62
# adding tray icon to the unpacked resources
63
install -vDm644 "$srcdir/notion.png" "$srcdir/asar_patched/.webpack/main/trayIcon.png"
64
local index_js="$srcdir/asar_patched/.webpack/main/index.js"
65
local sg_flags=(--lang javascript -U)
66
sg_patch() {
67
ast-grep run "${sg_flags[@]}" -p "$1" -r "$2" "$index_js" >/dev/null 2>&1
68
}
69
sg_patch_select() {
70
ast-grep run "${sg_flags[@]}" --selector "$1" -p "$2" -r "$3" "$index_js" >/dev/null 2>&1
71
}
72
# Linux desktop patches. Match on behavior anchors instead of exact minified variable names.
73
sg_patch \
74
'this.tray.on("click",()=>{this.onClick()})' \
75
'this.tray.setContextMenu(this.trayMenu),this.tray.on("click",()=>{this.onClick()})'
76
sg_patch_select method_definition \
77
'class X { getIcon(){ $$$BODY } }' \
78
'getIcon(){return require("path").resolve(__dirname,"trayIcon.png");}'
79
sg_patch \
80
'$S.setUserAgent(`${$S.getUserAgent()} WantsServiceWorker`)' \
81
'$S.setUserAgent(`${$S.getUserAgent().replace("Linux", "Windows")} WantsServiceWorker`)'
82
sg_patch \
83
'function $F(){const $$$P;if("darwin"===process.platform){$$$A}if("win32"===process.platform){$$$B}return!1}' \
84
'function $F(){return!0}'
85
sg_patch \
86
'if("darwin"===process.platform)$MAC;else if("win32"===process.platform){const $UNINSTALL=$ARGS=>$ARGS.find($ARG=>"--uninstall"===$ARG);$$$B}' \
87
'if("darwin"===process.platform)$MAC;else if("linux"===process.platform){const $UNINSTALL=$ARGS=>$ARGS.find($ARG=>"--uninstall"===$ARG);$$$B}'
88
# System Electron includes app.asar in argv; do not treat it as a Markdown file.
89
sg_patch \
90
'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&!$ARG.startsWith(`${$CONFIG.default.protocol}:`)&&$EXT.length>0&&".exe"!==$EXT}' \
91
'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&!$ARG.startsWith(`${$CONFIG.default.protocol}:`)&&$EXT.length>0&&".exe"!==$EXT&&".asar"!==$EXT}'
92
sg_patch \
93
'($$$PRE,function(){$$$INIT}(),0)' \
94
'($$$PRE,function(){$$$INIT}())'
95
sg_patch_select ternary_expression \
96
'"win32"===process.platform?function($E,$T){$$$A}($E,$T):$ALT' \
97
'"linux"===process.platform?function($E,$T){$$$A}($E,$T):$ALT'
98
# this can disable app menu when the options won't work. disbled in the current version because it's working now, but it's here for future reference
99
# sed -i 's|Menu.setApplicationMenu(p(e))|Menu.setApplicationMenu(null)|g' "$srcdir/asar_patched/.webpack/main/index.js"
100
# repacking asar with all the patches
101
asar p "$srcdir/asar_patched" "$srcdir/app.asar" --unpack *.node
102
}
103
104
package() {
105
local usr="$pkgdir/usr"
106
local share="$usr/share"
107
local lib="$usr/lib/notion-app"
108
109
install -d "$lib"
110
cp "$srcdir/app.asar" "$lib"
111
cp "$srcdir/app.asar.unpacked" "$lib" -r
112
install -vDm644 "$srcdir/asar_patched/package.json" "$lib/package.json"
113
install -vDm755 notion-app -t "$usr/bin"
114
install -vDm644 "$srcdir/notion.desktop" -t "$share/applications"
115
install -vDm644 "$srcdir/notion.png" -t "$share/icons/hicolor/256x256/apps"
116
}
117
Changes since previous scan
--- PKGBUILD @ 2026-07-21 00:24+++ PKGBUILD @ 2026-08-03 00:08@@ -4,7 +4,7 @@ # Contributor: Jaime Martínez Rincón <jaime@jamezrin.name> pkgname=notion-app-electron-pkgver=7.25.0+pkgver=7.27.0 _bettersqlite3ver=12.9.0 _bufferutilver=4.0.9 _elecronver=145 # whenever update the bettersqlite, update this one by one to try the proper version.@@ -35,7 +35,7 @@ notion.desktop notion.png )-sha256sums=('acab293a256863c6b78586f32f93774cd1edb5cd6213da1a615142628c90e975'+sha256sums=('5815ce1364f94f9832f375cb3941fc49fce8b45a84f7096b5fa99771d5693aab' '59d9e3beed32ff516fa79fc09bfb819a7abd84d077a77abfc68d85a6d79ac757' '2139aae79c5a4fd4d07467bd9b7872ea109483aa43b3dfd6c8d3725ccba009be' '916f75f612d353651d3d04a414c29d157521a06765683742a66279acac904744'@@ -85,9 +85,10 @@ sg_patch \ 'if("darwin"===process.platform)$MAC;else if("win32"===process.platform){const $UNINSTALL=$ARGS=>$ARGS.find($ARG=>"--uninstall"===$ARG);$$$B}' \ 'if("darwin"===process.platform)$MAC;else if("linux"===process.platform){const $UNINSTALL=$ARGS=>$ARGS.find($ARG=>"--uninstall"===$ARG);$$$B}'+ # System Electron includes app.asar in argv; do not treat it as a Markdown file. sg_patch \- 'if($COND){$$$A}else $APP.app.quit()' \- 'if($COND){$$$A}else return $APP.app.quit(),1;'+ 'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&!$ARG.startsWith(`${$CONFIG.default.protocol}:`)&&$EXT.length>0&&".exe"!==$EXT}' \+ 'function $F($ARG){const $EXT=$PATH.default.extname($ARG).toLowerCase();return!$ARG.startsWith("-")&&!$ARG.startsWith(`${$CONFIG.default.protocol}:`)&&$EXT.length>0&&".exe"!==$EXT&&".asar"!==$EXT}' sg_patch \ '($$$PRE,function(){$$$INIT}(),0)' \ '($$$PRE,function(){$$$INIT}())'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 17:17:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |