superhuman

MEDIUM

maintainer joeyeamigh 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads and executes a prebuilt Windows executable from a non-standard host (superhuman.com) and repacks it after extracting and modifying its contents, creating a supply-chain risk due to unverifiable origin and lack of checksum for the main binary.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:61 npm install --silent @electron/asar acorn

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:66 npx @electron/asar extract app-win/resources/app.asar asar-contents
PKGBUILD:80 npx @electron/asar pack asar-contents app.asar

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "Superhuman-${pkgver}.exe::https://assets.mail.superhuman.com/webapp/download/Superhuman.exe"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads and executes a prebuilt Windows executable from a non-standard host (superhuman.com) and repacks it after extracting and modifying its contents, creating a supply-chain risk due to unverifiable origin and lack of checksum for the main binary.

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Joey Eamigh @JoeyEamigh on GitHub
    
      2
    
      3# shellcheck shell=bash
    
      4# shellcheck disable=SC2034  # Variables used by makepkg
    
      5# shellcheck disable=SC2154  # srcdir/pkgdir/startdir set by makepkg
    
      6
    
      7pkgname=superhuman
    
      8pkgver=1044.0.1
    
      9pkgrel=1
    
      10pkgdesc="The fastest email experience ever made (unofficial)"
    
      11arch=('x86_64')
    
      12url="https://superhuman.com"
    
      13license=('custom:proprietary')
    
      14depends=('gtk3' 'nss' 'alsa-lib' 'libcups' 'libxkbcommon' 'libdrm' 'mesa' 'libnotify')
    
      15makedepends=('p7zip' 'nodejs' 'npm' 'wget' 'unzip')
    
      16optdepends=(
    
      17    'libappindicator-gtk3: System tray support'
    
      18    'xdg-utils: Protocol handler registration'
    
      19)
    
      20options=('!strip')
    
      21install=superhuman.install
    
      22source=(
    
      23    "Superhuman-${pkgver}.exe::https://assets.mail.superhuman.com/webapp/download/Superhuman.exe"
    
      24    "linux_patches.js"
    
      25    "linux_shim.js"
    
      26)
    
      27sha256sums=('SKIP'
    
      28            'e7354121be70d07d6a69150bb37376a2a16b9253b17762b723fb1a9a8714e56b'
    
      29            '859be0a8e8a72c25c8288380dae29e281cd9e20a81cc8ddb46d99537295afd20')
    
      30noextract=("Superhuman-${pkgver}.exe")
    
      31
    
      32_electron_version="44.9.3"
    
      33
    
      34prepare() {
    
      35    cd "$srcdir" || return
    
      36
    
      37    # Extract Windows installer
    
      38    msg2 "Extracting Windows installer..."
    
      39    mkdir -p extract
    
      40    7z x -y "Superhuman-${pkgver}.exe" -o"extract" > /dev/null
    
      41
    
      42    # Extract the app from app-64.7z
    
      43    mkdir -p app-win
    
      44    7z x -y "extract/\$PLUGINSDIR/app-64.7z" -o"app-win" > /dev/null
    
      45
    
      46    # Detect Electron version
    
      47    _electron_version=$(strings app-win/Superhuman.exe 2>/dev/null | grep -oP 'Electron/\K[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo "$_electron_version")
    
      48    msg2 "Detected Electron version: ${_electron_version}"
    
      49
    
      50    # Download Electron for Linux
    
      51    msg2 "Downloading Electron ${_electron_version}..."
    
      52    mkdir -p electron
    
      53    wget -q "https://github.com/electron/electron/releases/download/v${_electron_version}/electron-v${_electron_version}-linux-x64.zip" \
    
      54        -O electron/electron.zip
    
      55    cd electron || return
    
      56    unzip -qo electron.zip
    
      57    rm electron.zip
    
      58    cd ..
    
      59
    
      60    msg2 "Installing build tools..."
    
      61    npm install --silent @electron/asar acorn
    
      62
    
      63    # Extract app.asar
    
      64    msg2 "Extracting app.asar..."
    
      65    mkdir -p asar-contents
    
      66    npx @electron/asar extract app-win/resources/app.asar asar-contents
    
      67
    
      68    # Extract version from package.json
    
      69    if [ -f "asar-contents/package.json" ]; then
    
      70        _app_version=$(grep -oP '"version"\s*:\s*"\K[^"]+' asar-contents/package.json 2>/dev/null || echo "unknown")
    
      71        msg2 "Detected Superhuman version: ${_app_version}"
    
      72        echo "${_app_version}" > VERSION
    
      73    fi
    
      74
    
      75    msg2 "Applying Linux compatibility patches..."
    
      76    NODE_PATH="$srcdir/node_modules" node "$srcdir/linux_patches.js" asar-contents/dist/main.js
    
      77
    
      78    # Repack app.asar
    
      79    msg2 "Repacking app.asar..."
    
      80    npx @electron/asar pack asar-contents app.asar
    
      81}
    
      82
    
      83build() {
    
      84    cd "$srcdir" || return
    
      85
    
      86    mkdir -p superhuman-linux/resources
    
      87
    
      88    # Copy Electron files
    
      89    cp -r electron/* superhuman-linux/
    
      90
    
      91    # Remove default app
    
      92    rm -f superhuman-linux/resources/default_app.asar
    
      93
    
      94    # Copy patched app.asar
    
      95    cp app.asar superhuman-linux/resources/
    
      96
    
      97    # Copy version file
    
      98    [ -f VERSION ] && cp VERSION superhuman-linux/
    
      99
    
      100    # Rename electron binary
    
      101    mv superhuman-linux/electron superhuman-linux/superhuman-bin
    
      102
    
      103    # Create wrapper script
    
      104    cat > superhuman-linux/superhuman << 'WRAPPER'
    
      105#!/bin/bash
    
      106SCRIPT_DIR="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")" && pwd)"
    
      107
    
      108# Electron resolves the desktop entry from this when registering itself as the
    
      109# mailto:/superhuman: handler via xdg-settings.
    
      110export CHROME_DESKTOP="${CHROME_DESKTOP:-superhuman.desktop}"
    
      111
    
      112ARGS=()
    
      113for arg in "$@"; do
    
      114    if [[ "$arg" == superhuman://login* ]]; then
    
      115        ARGS+=("${arg/superhuman:\/\/login/superhuman://~login}")
    
      116    else
    
      117        ARGS+=("$arg")
    
      118    fi
    
      119done
    
      120
    
      121exec "${SCRIPT_DIR}/superhuman-bin" "${ARGS[@]}"
    
      122WRAPPER
    
      123    chmod +x superhuman-linux/superhuman
    
      124}
    
      125
    
      126package() {
    
      127    cd "$srcdir" || return
    
      128
    
      129    # Install main application
    
      130    install -dm755 "$pkgdir/opt/superhuman"
    
      131    cp -r superhuman-linux/* "$pkgdir/opt/superhuman/"
    
      132    chmod +x "$pkgdir/opt/superhuman/superhuman"
    
      133    chmod +x "$pkgdir/opt/superhuman/superhuman-bin"
    
      134    chmod +x "$pkgdir/opt/superhuman/chrome_crashpad_handler"
    
      135
    
      136    # Fallback sandbox for kernels without unprivileged user namespaces
    
      137    chmod 4755 "$pkgdir/opt/superhuman/chrome-sandbox"
    
      138
    
      139    # Install icon (check both locations: assets/ for GitHub, root for AUR)
    
      140    local icon_src=""
    
      141    if [ -f "$startdir/assets/superhuman.png" ]; then
    
      142        icon_src="$startdir/assets/superhuman.png"
    
      143    elif [ -f "$startdir/superhuman.png" ]; then
    
      144        icon_src="$startdir/superhuman.png"
    
      145    fi
    
      146    if [ -n "$icon_src" ]; then
    
      147        install -Dm644 "$icon_src" "$pkgdir/usr/share/icons/hicolor/256x256/apps/superhuman.png"
    
      148        cp "$icon_src" "$pkgdir/opt/superhuman/"
    
      149    fi
    
      150
    
      151    install -Dm644 superhuman-linux/LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron"
    
      152
    
      153    # Create bin symlinks
    
      154    install -dm755 "$pkgdir/usr/bin"
    
      155    ln -s /opt/superhuman/superhuman "$pkgdir/usr/bin/superhuman"
    
      156
    
      157    # Install desktop file
    
      158    install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/superhuman.desktop" << 'EOF'
    
      159[Desktop Entry]
    
      160Name=Superhuman
    
      161Comment=The fastest email experience ever made
    
      162Exec=/opt/superhuman/superhuman %U
    
      163Icon=superhuman
    
      164Type=Application
    
      165Categories=Network;Email;
    
      166MimeType=x-scheme-handler/mailto;x-scheme-handler/superhuman;
    
      167StartupWMClass=superhuman
    
      168Terminal=false
    
      169X-KDE-Protocols=mailto;superhuman;
    
      170EOF
    
      171
    
      172    # Install autostart file (disabled by default)
    
      173    install -Dm644 /dev/stdin "$pkgdir/etc/xdg/autostart/superhuman.desktop" << 'EOF'
    
      174[Desktop Entry]
    
      175Name=Superhuman
    
      176Comment=The fastest email experience ever made
    
      177Exec=/opt/superhuman/superhuman --hidden
    
      178Icon=superhuman
    
      179Type=Application
    
      180Terminal=false
    
      181X-GNOME-Autostart-enabled=false
    
      182Hidden=true
    
      183NoDisplay=true
    
      184EOF
    
      185}
    
      186

Changes since previous scan

--- PKGBUILD @ 2026-10-30 00:29
+++ PKGBUILD @ 2026-11-01 00:21
@@ -5,7 +5,7 @@
 # shellcheck disable=SC2154  # srcdir/pkgdir/startdir set by makepkg
 
 pkgname=superhuman
-pkgver=1041.0.77
+pkgver=1044.0.1
 pkgrel=1
 pkgdesc="The fastest email experience ever made (unofficial)"
 arch=('x86_64')
@@ -29,7 +29,7 @@
             '859be0a8e8a72c25c8288380dae29e281cd9e20a81cc8ddb46d99537295afd20')
 noextract=("Superhuman-${pkgver}.exe")
 
-_electron_version="41.10.6"
+_electron_version="44.9.3"
 
 prepare() {
     cd "$srcdir" || return

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	4
2026-10-31 11:58:11	Medium	4
2026-10-31 00:07:41	Medium	4
2026-10-30 13:56:02	Medium	4
2026-10-30 00:29:30	Medium	4
2026-10-29 13:52:19	Medium	4
2026-10-29 00:13:55	Medium	4
2026-10-28 13:50:29	Medium	4
2026-10-28 00:06:54	Medium	4
2026-10-27 00:23:28	Medium	4
2026-10-26 00:12:40	Medium	4
2026-10-25 00:20:48	Medium	4
2026-10-24 00:14:55	Medium	4
2026-10-23 00:02:19	Medium	4
2026-10-22 00:13:10	Medium	4
2026-10-21 00:12:50	Medium	4
2026-10-20 00:10:31	Medium	4
2026-10-19 00:03:55	Medium	4
2026-10-18 00:06:55	Medium	4
2026-10-17 11:18:02	Medium	4