Free evaluation release for checking shipped Electron ASAR packages. It reads package bytes without running application code. Requires Node 22.12+ and npm. Verified on Windows x64 with Node 24.8.0.
From this directory:
npm ci --ignore-scripts
node cli.mjs "C:\path\resources\app.asar" --out "C:\path\new-report"Keep app.asar.unpacked beside app.asar when the package supplies it. The report directory must not already exist. Reports include JSON for automation and Markdown for inspection.
The package.json main entry is automatic. Add known preload entries explicitly:
node cli.mjs "C:\path\app.asar" --entry dist/main/preload.js --out "C:\path\new-report"Preload object properties and simple path.join(__dirname, ...) expressions are discovered as candidates. They remain unknown until explicitly included because syntax alone does not establish a BrowserWindow preload.
| Exit | Verdict | Meaning |
|---|---|---|
| 3 | fail | A required static packaging reference cannot resolve, a declared entry is absent, or a manifest-declared unpacked file is absent. Unknowns may also exist. |
| 2 | incomplete/error | No confirmed missing reference, but unsupported or conditional behavior remains. Input/operation errors also return 2 and print a diagnostic. |
| 0 | pass | No detected gap or unknown in the supported traversal. This is not a full runtime health guarantee. |
Findings distinguish missing, unknown, resolved, and provided. Node and Electron built-ins are provided by the runtime. Optional dependencies, conditional/deferred imports, dynamic expressions, shadowed require, and ES modules remain unknown. Native binary presence does not prove ABI compatibility.
A file path and line identify each literal import. A chain records how traversal reached it. The archive SHA256 and an extracted-content digest identify the tested inputs, including available unpacked files.
Uses official @electron/asar for archive reading and Acorn for JavaScript syntax. Traverses literal CommonJS imports from the main entry and explicit entries. Recognizes direct IIFEs and the standard CommonJS UMD environment guard. Reuses Node's CommonJS resolver, rejects results outside a fresh temporary extraction, and never installs target dependencies. No REA, global tools, target account, or paid service is needed.
This is narrower than Node File Trace. It intentionally does not treat broad trace warnings as failures. It does not prove all dynamic imports, arbitrary execution order, renderer assets, ESM resolution, native loading, or runtime behavior. Unknowns are retained rather than silently filtered. Paths with archive links are rejected. Extraction is capped at 100000 entries, 64 MiB per file and 512 MiB total, with a 20000-source traversal limit.
npm test
python verify-public.py --out evidence/public-checkThe optional public verifier requires Python 3.11+ and downloads four original upstream Debian packages without authentication. Download hashes are pinned. It checks a known broken/repaired Cider pair plus MarkText and Caprine. It extracts only Electron resources and does not install or launch these apps. Normal CLI use requires only Node, npm, your ASAR, and its unpacked companion.
Download the source ZIP and SHA256SUMS from Releases. After extraction, run the commands above. No global package installation or REA setup is needed. To reproduce clean-install verification: python build-release.py, then python verify-install.py --zip dist/electron-package-check-source.zip --out evidence/fresh-install.
Results and limits: VERIFICATION.md. Hosted verification runs on Windows and Linux with Node 22 and 24. See GitHub Actions. This evaluation license permits testing and evaluation, not commercial service use. See LICENSE.