superhuman

maintainer joeyeamigh · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads and executes unverifiable prebuilt binaries (Superhuman.exe) from a non-standard host (assets.mail.superhuman.com) with SKIP'd checksums, posing a supply-chain risk if the source were swapped.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:72 npm install --silent @electron/asar

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:77 npx @electron/asar extract app-win/resources/app.asar asar-contents
PKGBUILD:91 npx @electron/asar pack asar-contents app.asar

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "Superhuman-${pkgver}.exe::https://assets.mail.superhuman.com/webapp/download/Superhuman.exe"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads and executes unverifiable prebuilt binaries (Superhuman.exe) from a non-standard host (assets.mail.superhuman.com) with SKIP'd checksums, posing a supply-chain risk if the source were swapped.

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Joey Eamigh @JoeyEamigh on GitHub
    
      2
    
      3# shellcheck shell=bash
    
      4# shellcheck disable=SC2034  # Variables used by makepkg
    
      5# shellcheck disable=SC2154  # srcdir/pkgdir/startdir set by makepkg
    
      6
    
      7pkgname=superhuman
    
      8pkgver=1041.0.26
    
      9pkgrel=1
    
      10pkgdesc="The fastest email experience ever made (unofficial)"
    
      11arch=('x86_64')
    
      12url="https://superhuman.com"
    
      13license=('custom:proprietary')
    
      14depends=('gtk3' 'nss' 'alsa-lib' 'libxss' 'libxtst' 'libdrm' 'mesa' 'libnotify')
    
      15makedepends=('p7zip' 'nodejs' 'npm' 'wget' 'unzip')
    
      16optdepends=(
    
      17    'libappindicator-gtk3: System tray support'
    
      18    'xdg-utils: Protocol handler registration'
    
      19)
    
      20options=('!strip')
    
      21install=superhuman.install
    
      22source=(
    
      23    "Superhuman-${pkgver}.exe::https://assets.mail.superhuman.com/webapp/download/Superhuman.exe"
    
      24    "linux_tray.js"
    
      25)
    
      26sha256sums=('SKIP' 'SKIP')
    
      27noextract=("Superhuman-${pkgver}.exe")
    
      28
    
      29_electron_version="41.6.1"
    
      30_patch_failures=0
    
      31
    
      32# Automatically detect version from the downloaded exe
    
      33# Uncomment pkgver() for -git style versioning
    
      34# pkgver() {
    
      35#     cd "$srcdir"
    
      36#     if [ -f "VERSION" ]; then
    
      37#         cat VERSION
    
      38#     else
    
      39#         echo "1.0.0"
    
      40#     fi
    
      41# }
    
      42
    
      43prepare() {
    
      44    cd "$srcdir" || return
    
      45    _patch_failures=0
    
      46
    
      47    # Extract Windows installer
    
      48    msg2 "Extracting Windows installer..."
    
      49    mkdir -p extract
    
      50    7z x -y "Superhuman-${pkgver}.exe" -o"extract" > /dev/null
    
      51
    
      52    # Extract the app from app-64.7z
    
      53    mkdir -p app-win
    
      54    7z x -y "extract/\$PLUGINSDIR/app-64.7z" -o"app-win" > /dev/null
    
      55
    
      56    # Detect Electron version
    
      57    _electron_version=$(strings app-win/Superhuman.exe 2>/dev/null | grep -oP 'Electron/\K[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo "$_electron_version")
    
      58    msg2 "Detected Electron version: ${_electron_version}"
    
      59
    
      60    # Download Electron for Linux
    
      61    msg2 "Downloading Electron ${_electron_version}..."
    
      62    mkdir -p electron
    
      63    wget -q "https://github.com/electron/electron/releases/download/v${_electron_version}/electron-v${_electron_version}-linux-x64.zip" \
    
      64        -O electron/electron.zip
    
      65    cd electron || return
    
      66    unzip -qo electron.zip
    
      67    rm electron.zip
    
      68    cd ..
    
      69
    
      70    # Install asar tool
    
      71    msg2 "Installing asar tool..."
    
      72    npm install --silent @electron/asar
    
      73
    
      74    # Extract app.asar
    
      75    msg2 "Extracting app.asar..."
    
      76    mkdir -p asar-contents
    
      77    npx @electron/asar extract app-win/resources/app.asar asar-contents
    
      78
    
      79    # Extract version from package.json
    
      80    if [ -f "asar-contents/package.json" ]; then
    
      81        _app_version=$(grep -oP '"version"\s*:\s*"\K[^"]+' asar-contents/package.json 2>/dev/null || echo "unknown")
    
      82        msg2 "Detected Superhuman version: ${_app_version}"
    
      83        echo "${_app_version}" > VERSION
    
      84    fi
    
      85
    
      86    # Apply Linux compatibility patches
    
      87    _apply_patches
    
      88
    
      89    # Repack app.asar
    
      90    msg2 "Repacking app.asar..."
    
      91    npx @electron/asar pack asar-contents app.asar
    
      92}
    
      93
    
      94# Graceful patch function - warns on failure instead of breaking build
    
      95_safe_sed_patch() {
    
      96    local desc="$1"
    
      97    local file="$2"
    
      98    local pattern="$3"
    
      99    local replacement="$4"
    
      100    local replace_all="${5:-false}"
    
      101
    
      102    if [ ! -f "$file" ]; then
    
      103        warning "PATCH FAILED: $desc"
    
      104        warning "  File not found: $(basename "$file")"
    
      105        warning "  >>> MAINTAINER: App structure changed, update needed <<<"
    
      106        ((_patch_failures++)) || true
    
      107        return 1
    
      108    fi
    
      109
    
      110    if ! grep -q "$pattern" "$file" 2>/dev/null; then
    
      111        warning "PATCH FAILED: $desc"
    
      112        warning "  Pattern not found in: $(basename "$file")"
    
      113        warning "  >>> MAINTAINER: App code changed, update needed <<<"
    
      114        ((_patch_failures++)) || true
    
      115        return 1
    
      116    fi
    
      117
    
      118    if [ "$replace_all" = "true" ]; then
    
      119        sed -i "s#$pattern#$replacement#g" "$file"
    
      120    else
    
      121        sed -i "s#$pattern#$replacement#" "$file"
    
      122    fi
    
      123
    
      124    msg2 "Applied: $desc"
    
      125    return 0
    
      126}
    
      127
    
      128_safe_insert_patch() {
    
      129    local desc="$1"
    
      130    local file="$2"
    
      131    local after_pattern="$3"
    
      132    local text="$4"
    
      133
    
      134    if [ ! -f "$file" ]; then
    
      135        warning "PATCH FAILED: $desc - File not found"
    
      136        warning "  >>> MAINTAINER: App structure changed, update needed <<<"
    
      137        ((_patch_failures++)) || true
    
      138        return 1
    
      139    fi
    
      140
    
      141    if ! grep -q "$after_pattern" "$file" 2>/dev/null; then
    
      142        warning "PATCH FAILED: $desc - Pattern not found"
    
      143        warning "  >>> MAINTAINER: App code changed, update needed <<<"
    
      144        ((_patch_failures++)) || true
    
      145        return 1
    
      146    fi
    
      147
    
      148    sed -i "/$after_pattern/a\\
    
      149$text" "$file"
    
      150    msg2 "Applied: $desc"
    
      151    return 0
    
      152}
    
      153
    
      154_apply_patches() {
    
      155    msg2 "Applying Linux compatibility patches..."
    
      156    local src_dir="$srcdir/asar-contents/src"
    
      157
    
      158    # =========================================================================
    
      159    # CORE PATCHES
    
      160    # =========================================================================
    
      161
    
      162    _safe_sed_patch \
    
      163        "Memory poller: Linux support" \
    
      164        "${src_dir}/native_memory_poller.js" \
    
      165        "if (process.platform === 'darwin') {" \
    
      166        "if (process.platform === 'darwin' || process.platform === 'linux') {" \
    
      167        true
    
      168
    
      169    _safe_sed_patch \
    
      170        "Window: Ctrl shortcuts for Linux" \
    
      171        "${src_dir}/window.js" \
    
      172        "} else if (process.platform === 'win32') {" \
    
      173        "} else if (process.platform === 'win32' || process.platform === 'linux') {" \
    
      174        true
    
      175
    
      176    _safe_sed_patch \
    
      177        "Window: Zoom control for Linux" \
    
      178        "${src_dir}/window.js" \
    
      179        "(process.platform === 'win32' && input.control)" \
    
      180        "((process.platform === 'win32' || process.platform === 'linux') \\&\\& input.control)" \
    
      181        true
    
      182
    
      183    _safe_sed_patch \
    
      184        "Main: Linux argv URL handling" \
    
      185        "${src_dir}/main.js" \
    
      186        "} else if (process.platform === 'win32') {" \
    
      187        "} else if (process.platform === 'win32' || process.platform === 'linux') {" \
    
      188        true
    
      189
    
      190    _safe_sed_patch \
    
      191        "Main: Fix async download handler" \
    
      192        "${src_dir}/main.js" \
    
      193        "await fs.promises.mkdir(downloadsLocation, { recursive: true })" \
    
      194        "fs.mkdirSync(downloadsLocation, { recursive: true })"
    
      195
    
      196    # =========================================================================
    
      197    # AUTO-UPDATER - Skip on Linux (use pacman)
    
      198    # =========================================================================
    
      199
    
      200    if [ -f "${src_dir}/updater.js" ] && grep -q "if (appConfig.isDev) {" "${src_dir}/updater.js"; then
    
      201        _safe_insert_patch \
    
      202            "Updater: Skip on Linux" \
    
      203            "${src_dir}/updater.js" \
    
      204            "if (appConfig.isDev) {" \
    
      205"\\    // Linux: Use system package manager for updates\\
    
      206\\    if (process.platform === 'linux') {\\
    
      207\\      console.log('[Superhuman Linux] Updates managed by pacman');\\
    
      208\\      return;\\
    
      209\\    }"
    
      210    fi
    
      211
    
      212    # =========================================================================
    
      213    # TRAY MODULE - Close to tray with account switcher
    
      214    # =========================================================================
    
      215
    
      216    cp "$srcdir/linux_tray.js" "${src_dir}/linux_tray.js"
    
      217
    
      218    # Import and initialize tray - the module self-initializes via app events
    
      219    sed -i "1i\\
    
      220if (process.platform === 'linux') { require('./linux_tray'); }" \
    
      221        "${src_dir}/main.js"
    
      222
    
      223    msg2 "Applied: Tray module (self-initializing)"
    
      224
    
      225    # =========================================================================
    
      226    # PATCH SUMMARY
    
      227    # =========================================================================
    
      228
    
      229    if [ $_patch_failures -gt 0 ]; then
    
      230        warning "=========================================="
    
      231        warning "$_patch_failures patch(es) failed!"
    
      232        warning "The app may work but some features might be broken."
    
      233        warning ">>> MAINTAINER: Superhuman updated, patches need review <<<"
    
      234        warning "=========================================="
    
      235    fi
    
      236}
    
      237
    
      238build() {
    
      239    cd "$srcdir" || return
    
      240
    
      241    mkdir -p superhuman-linux/resources
    
      242
    
      243    # Copy Electron files
    
      244    cp -r electron/* superhuman-linux/
    
      245
    
      246    # Remove default app
    
      247    rm -f superhuman-linux/resources/default_app.asar
    
      248
    
      249    # Copy patched app.asar
    
      250    cp app.asar superhuman-linux/resources/
    
      251
    
      252    # Copy version file
    
      253    [ -f VERSION ] && cp VERSION superhuman-linux/
    
      254
    
      255    # Rename electron binary
    
      256    mv superhuman-linux/electron superhuman-linux/superhuman-bin
    
      257
    
      258    # Create wrapper script
    
      259    cat > superhuman-linux/superhuman << 'WRAPPER'
    
      260#!/bin/bash
    
      261SCRIPT_DIR="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")" && pwd)"
    
      262
    
      263ARGS=()
    
      264for arg in "$@"; do
    
      265    if [[ "$arg" == superhuman://login* ]]; then
    
      266        ARGS+=("${arg/superhuman:\/\/login/superhuman://~login}")
    
      267    else
    
      268        ARGS+=("$arg")
    
      269    fi
    
      270done
    
      271
    
      272exec "${SCRIPT_DIR}/superhuman-bin" --no-sandbox "${ARGS[@]}"
    
      273WRAPPER
    
      274    chmod +x superhuman-linux/superhuman
    
      275}
    
      276
    
      277package() {
    
      278    cd "$srcdir" || return
    
      279
    
      280    # Install main application
    
      281    install -dm755 "$pkgdir/opt/superhuman"
    
      282    cp -r superhuman-linux/* "$pkgdir/opt/superhuman/"
    
      283    chmod +x "$pkgdir/opt/superhuman/superhuman"
    
      284    chmod +x "$pkgdir/opt/superhuman/superhuman-bin"
    
      285    chmod +x "$pkgdir/opt/superhuman/chrome_crashpad_handler"
    
      286    chmod 4755 "$pkgdir/opt/superhuman/chrome-sandbox" 2>/dev/null || true
    
      287
    
      288    # Install icon (check both locations: assets/ for GitHub, root for AUR)
    
      289    local icon_src=""
    
      290    if [ -f "$startdir/assets/superhuman.png" ]; then
    
      291        icon_src="$startdir/assets/superhuman.png"
    
      292    elif [ -f "$startdir/superhuman.png" ]; then
    
      293        icon_src="$startdir/superhuman.png"
    
      294    fi
    
      295    if [ -n "$icon_src" ]; then
    
      296        install -Dm644 "$icon_src" "$pkgdir/usr/share/icons/hicolor/256x256/apps/superhuman.png"
    
      297        cp "$icon_src" "$pkgdir/opt/superhuman/"
    
      298    fi
    
      299
    
      300    # Create bin symlinks
    
      301    install -dm755 "$pkgdir/usr/bin"
    
      302    ln -s /opt/superhuman/superhuman "$pkgdir/usr/bin/superhuman"
    
      303
    
      304    # Install desktop file
    
      305    install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/superhuman.desktop" << 'EOF'
    
      306[Desktop Entry]
    
      307Name=Superhuman
    
      308Comment=The fastest email experience ever made
    
      309Exec=/opt/superhuman/superhuman %U
    
      310Icon=superhuman
    
      311Type=Application
    
      312Categories=Network;Email;
    
      313MimeType=x-scheme-handler/mailto;x-scheme-handler/superhuman;
    
      314StartupWMClass=Superhuman
    
      315Terminal=false
    
      316X-KDE-Protocols=mailto;superhuman;
    
      317EOF
    
      318
    
      319    # Install autostart file (disabled by default)
    
      320    install -Dm644 /dev/stdin "$pkgdir/etc/xdg/autostart/superhuman.desktop" << 'EOF'
    
      321[Desktop Entry]
    
      322Name=Superhuman
    
      323Comment=The fastest email experience ever made
    
      324Exec=/opt/superhuman/superhuman --hidden
    
      325Icon=superhuman
    
      326Type=Application
    
      327Terminal=false
    
      328X-GNOME-Autostart-enabled=false
    
      329Hidden=true
    
      330NoDisplay=true
    
      331EOF
    
      332}
    
      333

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -5,7 +5,7 @@
 # shellcheck disable=SC2154  # srcdir/pkgdir/startdir set by makepkg
 
 pkgname=superhuman
-pkgver=1041.0.24
+pkgver=1041.0.26
 pkgrel=1
 pkgdesc="The fastest email experience ever made (unofficial)"
 arch=('x86_64')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	4
2026-08-02 00:16:08	MEDIUM	4
2026-08-01 09:20:18	MEDIUM	4
2026-08-01 00:11:18	MEDIUM	4
2026-07-31 00:14:10	MEDIUM	4
2026-07-30 00:17:23	MEDIUM	4
2026-07-29 00:25:53	MEDIUM	4
2026-07-28 00:07:28	MEDIUM	4
2026-07-27 00:24:32	MEDIUM	4
2026-07-26 00:07:32	MEDIUM	4
2026-07-25 00:13:44	MEDIUM	4
2026-07-24 09:27:42	MEDIUM	4
2026-07-24 00:02:28	MEDIUM	4
2026-07-23 00:14:47	MEDIUM	4
2026-07-22 00:29:32	MEDIUM	4
2026-07-21 00:24:15	MEDIUM	4
2026-07-20 00:19:49	MEDIUM	4
2026-07-19 00:17:08	MEDIUM	4
2026-07-18 00:14:48	MEDIUM	4
2026-07-17 00:06:16	MEDIUM	4