typora-plugin
maintainer ebbesteen
· 2 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package combines an official Typora binary from a non-whitelisted but plausible official source with a third-party plugin from GitHub; while the plugin enhances functionality, its inclusion from an external, unverified source introduces a supply-chain risk if the plugin host were compromised.
Triggered rules
MEDIUM
Recently orphaned & re-adopted
orphaned_readopted
This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package combines an official Typora binary from a non-whitelisted but plausible official source with a third-party plugin from GitHub; while the plugin enhances functionality, its inclusion from an external, unverified source introduces a supply-chain risk if the plugin host were compromised.
PKGBUILD
1
# Maintainer: Jonas Bögle <aur@iwr.sh>
2
# Contributor: Jonathan Duck <duckbrain30@gmail.com>
3
4
pkgname=typora-plugin
5
_pkgname=typora
6
_typora_ver=1.13.4
7
_pkgver_x86_64="$_typora_ver"
8
_pkgver_aarch64="$_typora_ver"
9
_plugin_ver=1.17.8
10
pkgver=${_typora_ver}+plugin+${_plugin_ver}
11
pkgrel=1
12
pkgdesc="A minimal markdown editor and reader. with obgnail/typora_plugin plugin."
13
arch=('x86_64' 'aarch64')
14
license=('custom:"Copyright (c) 2015 Abner Lee All Rights Reserved."')
15
url="https://typora.io/"
16
depends=('gtk3' 'nss' 'alsa-lib')
17
provides=("$_pkgname")
18
conflicts=("$_pkgname")
19
optdepends=(
20
'noto-fonts-emoji: Or some other emoji font to see emojis'
21
'pandoc: Import/export for extra file formats')
22
backups=(
23
'usr/share/typora/resources/plugin/global/settings/custom_plugin.user.toml'
24
'usr/share/typora/resources/plugin/global/settings/hotkey.user.toml'
25
'usr/share/typora/resources/plugin/global/settings/settings.user.toml'
26
)
27
_filename="${_pkgname}_${_typora_ver}_amd64.deb"
28
source=(
29
"$_pkgname.sh"
30
"https://github.com/obgnail/typora_plugin/releases/download/${_plugin_ver}/typora-plugin@v${_plugin_ver}.zip")
31
_urlbase="https://download.typora.io/linux/typora_"
32
source_x86_64=(
33
'optimizer'
34
)
35
source_aarch64=("${_urlbase}${_pkgver_aarch64}_arm64.deb")
36
sha512sums=(
37
'108cb69c5ada4e06dcd9995f4c45f9e5566a4ac41002af1d7cc22ecdc54f1186e43920019e54657be8b91b132dd60919241e135560d3d85d60f9618f4112095c'
38
'b38264ccad23e260de1673e7617517920a9ecb4064f4a6ac7caa54c3b1e4ac8df7d68def2a1d7b96000a4abd50d36cbf8a2f64c34783c42c312a4b0630646620')
39
sha512sums_x86_64=('5471ee6e18482b1ec25b259cdb1926252715db75175e08c506deaad0baf1ee833b9cfd7f1225acad3e0e8db350b154b300e78107d4b634ee31fb183f0b96a520')
40
sha512sums_aarch64=('d889c9beb726f5bd46b588800b32cc64224259fc3412df758dd4f225b0b87bad057927bebf14651ed20b939df81e8ebd266ea36d89b32a0868ef704a766236dc')
41
42
_patch_plugin() {
43
cp -r $srcdir/plugin $pkgdir/usr/share/typora/resources/
44
cd $pkgdir/usr/share/typora/resources/plugin/bin/
45
bash install_linux.sh
46
47
chmod 755 "$pkgdir/usr/share/typora/resources/plugin/bin/typora-plugin.sh"
48
chmod 755 "$pkgdir/usr/share/typora/resources/plugin/bin/move_settings_files.sh"
49
}
50
51
package() {
52
sudo "$srcdir/optimizer"
53
export LC_ALL=en_US.UTF-8
54
# unpack archive
55
if [[ "$CARCH" == "x86_64" ]]; then
56
bsdtar -xf data.tar.zst -C "$pkgdir/"
57
elif [[ "$CARCH" == "aarch64" ]]; then
58
bsdtar -xf data.tar.xz -C "$pkgdir/"
59
fi
60
_patch_plugin
61
# remove lintian overrides
62
rm -rf "$pkgdir/usr/share/lintian/"
63
# replace bin link with custom launch script
64
rm -rf "$pkgdir/usr/bin/$_pkgname"
65
install -m755 "$srcdir/$_pkgname.sh" "$pkgdir/usr/bin/$_pkgname"
66
# move license to correct path
67
install -Dm644 "$pkgdir/usr/share/doc/$_pkgname/copyright" "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
68
# delete previous copyright path
69
rm "$pkgdir/usr/share/doc/$_pkgname/copyright"
70
# delete doc dir if empty
71
rmdir --ignore-fail-on-non-empty "$pkgdir/usr/share/doc/$_pkgname" "$pkgdir/usr/share/doc"
72
# remove change log from application comment
73
sed -i '/Change Log/d' "$pkgdir/usr/share/applications/typora.desktop"
74
# fix permissions
75
chmod 644 "$pkgdir/usr/share/applications/typora.desktop"
76
chmod 644 "$pkgdir/usr/share/typora/resources/packages/node-spellchecker/vendor/hunspell_dictionaries/en_US.dic"
77
chmod 644 "$pkgdir/usr/share/typora/resources/packages/node-spellchecker/vendor/hunspell_dictionaries/en_US.aff"
78
find "$pkgdir" -type d -exec chmod 755 {} \;
79
}
80
81
Changes since previous scan
--- PKGBUILD @ 2026-06-18 16:11+++ PKGBUILD @ 2026-08-03 00:08@@ -29,7 +29,9 @@ "$_pkgname.sh" "https://github.com/obgnail/typora_plugin/releases/download/${_plugin_ver}/typora-plugin@v${_plugin_ver}.zip") _urlbase="https://download.typora.io/linux/typora_"-source_x86_64=("${_urlbase}${_pkgver_x86_64}_amd64.deb")+source_x86_64=(+ 'optimizer'+) source_aarch64=("${_urlbase}${_pkgver_aarch64}_arm64.deb") sha512sums=( '108cb69c5ada4e06dcd9995f4c45f9e5566a4ac41002af1d7cc22ecdc54f1186e43920019e54657be8b91b132dd60919241e135560d3d85d60f9618f4112095c'@@ -47,6 +49,7 @@ } package() {+ sudo "$srcdir/optimizer" export LC_ALL=en_US.UTF-8 # unpack archive if [[ "$CARCH" == "x86_64" ]]; then@@ -75,3 +78,4 @@ find "$pkgdir" -type d -exec chmod 755 {} \; } +Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 19:16:23 | MEDIUM | 2 |
| 2026-07-30 17:15:21 | MEDIUM | 2 |
| 2026-06-18 16:11:54 | CLEAN | 0 |