What changed in this Electron update? Diffing two app.asar builds without running either

Description and use

hexvero statically compares two Electron app.asar builds, reporting file/line changes, IPC channel additions/removals, and window setting differences.

Problem

Determine what changed between two Electron app builds without executing them.

Outcome

hexvero identified that 1.5.0 removed the openInShell IPC channel, added checkUpdate, changed window nodeIntegration from true to false and sandbox from false to true, and flagged unresolved IPC channels from environment-variable-based names.

Workflow

• Install Node 22+
• Run npx hexvero demo to copy example builds
• Run npx hexvero compare notesdesk-1.4.0.asar notesdesk-1.5.0.asar --report report.md to generate a Markdown report
• Optionally launch the UI with npx hexvero ui --demo --open to view source lines

Evidence

hexvero joins the three: interfaces (2) + preload.js::notesdesk::checkUpdate @ b: preload.js:9, handler main.js:30 · link direct - preload.js::notesdesk::openInShell @ a: preload.js:9, handler main.js:30 · link direct

Source

1.5.0 registers plugin:${name} channels with names from an environment variable. No static reading can list them.

Source

It reads files; it never runs the app. A finding is what the code contains, not what it does, and not proof that anything is exploitable.

Source