What changed in this Electron update? Diffing two app.asar builds without running either

Описание и применение

hexvero позволяет сравнивать два пакета Electron без запуска, выявляя изменения в IPC‑каналах и настройках окна.

Задача

Determine what changed between two Electron app builds without executing them.

Результат

hexvero identified that 1.5.0 removed the openInShell IPC channel, added checkUpdate, changed window nodeIntegration from true to false and sandbox from false to true, and flagged unresolved IPC channels from environment-variable-based names.

Рабочий процесс

• Install Node 22+
• Run npx hexvero demo to copy example builds
• Run npx hexvero compare notesdesk-1.4.0.asar notesdesk-1.5.0.asar --report report.md to generate a Markdown report
• Optionally launch the UI with npx hexvero ui --demo --open to view source lines

Доказательства

hexvero joins the three: interfaces (2) + preload.js::notesdesk::checkUpdate @ b: preload.js:9, handler main.js:30 · link direct - preload.js::notesdesk::openInShell @ a: preload.js:9, handler main.js:30 · link direct

Источник

1.5.0 registers plugin:${name} channels with names from an environment variable. No static reading can list them.

Источник

It reads files; it never runs the app. A finding is what the code contains, not what it does, and not proof that anything is exploitable.

Источник