Checked 2026-10-31 · hexvero 0.12.0

Moving from Electronegativity to hexvero

Run npx hexvero audit on one packaged build for the single-build checks, then hexvero check on the last release and the next one, so CI fails only on what a release changes. hexvero covers part of Electronegativity's checks, not all; the list below says which.

Why look for a replacement at all

Electronegativity by Doyensec was the best-known open-source static checker for Electron. Its README says it is no longer actively maintained, the repository was archived on 2026-10-24, and the last npm release, @doyensec/electronegativity 1.10.3, is from 2023-03-09. Doyensec's commercial successor is ElectroNG. hexvero is an independent MIT project, not affiliated with Doyensec and sharing no code with Electronegativity.

The same job on one build

$ npx hexvero audit dist/mac/YourApp.app                 # text
$ npx hexvero audit dist/mac/YourApp.app --format sarif  # for code scanning

Exit codes: 0 pass, 3 a rule is violated, 4 not decidable with --unknown fail, 1 error, 2 usage. It reads an app.asar, a .app, a Windows or Linux install directory or a release ZIP, and bundled or minified JavaScript inside them. Nothing is executed.

What is covered in 0.12.0

Electronegativity check	hexvero
NODE_INTEGRATION, CONTEXT_ISOLATION, SANDBOX (JS)	covered, per window, with the Electron version's defaults
REMOTE_MODULE	covered
CSP (HTML, JS, global)	covered: missing or weak, meta tag and header
OPEN_EXTERNAL	covered
PERMISSION_REQUEST_HANDLER	covered: missing, or granting everything
CERTIFICATE_ERROR_EVENT, CERTIFICATE_VERIFY_PROC, CUSTOM_ARGUMENTS (JS)	covered
WEB_SECURITY, INSECURE_CONTENT (JS), LIMIT_NAVIGATION	read, not judged by a rule yet
webview attributes, PROTOCOL_HANDLER, DANGEROUS_FUNCTIONS, EXPERIMENTAL and BLINK features, JSON script switches	not read yet
AUXCLICK, AFFINITY, 27 upgrade checks (Electron 5–8)	not planned: obsolete options or API migration

Every row with its check id and the planned rule: docs/engineering/audit-plan.md. Audit baselines and suppressions are not shipped yet; check has both.

What changes in how you work

From one build to two. hexvero check previous.asar next.asar --policy policy.json fails on a new preload member, a new external host, a more permissive window, a weakened fuse, a new openExternal, an allow-all permission handler or a weaker CSP, not on what was already there.
No source comments. Suppressions live in the policy, keyed by a fingerprint that names the item, never the line, with a reason and an optional expiry. Reformatting with Prettier changes nothing (Electronegativity issue #93).
Unknown stays unknown. A value computed at run time is reported as unresolved, and an Electron line hexvero has no data for is unknown, not an error (issue #106).
The line in both builds. Every change carries the file and line it was read from in the old and the new build; --report report.html shows both side by side.

Try it first on the example

$ npx hexvero demo
$ npx hexvero audit hexvero-demo/notesdesk-1.5.0.asar

NotesDesk is a small synthetic app shipped with hexvero; the audit reports an openExternal call at main.js:20, no permission handler and no CSP, and exits 3.