@siranjeevan/gitnest@1.0.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@siranjeevan/gitnest@1.0.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node bin/install.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L4: const path = require('path'); L5: const https = require('https'); L6: const { execSync } = require('child_process'); ... L16: if (platform === 'darwin') { L17: artifactName = arch === 'arm64' ? `gitnest-v${VERSION}-macos-arm64.tar.gz` : `gitnest-v${VERSION}-macos-x86_64.tar.gz`; L18: } else if (platform === 'linux') { L19: if (arch === 'x64') { L20: artifactName = `gitnest-v${VERSION}-linux-x86_64.tar.gz`; L21: } else { ... L31: L32: const downloadUrl = `https://github.com/${REPO}/releases/download/v${VERSION}/${artifactName}`; L33: const binDir = path.join(__dirname, '..', 'vendor');

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

•scripts.postinstall = node bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/config/model.rsView file

59patternName = google_api_key severity = high line = 59 matchedText = api_key:...g(),

High

High Secret

Package contains a high-severity secret pattern.

src/config/model.rsView on unpkg · L59

59patternName = google_api_key severity = high line = 59 matchedText = api_key:...g(),

High

Secret Pattern

Google API key in src/config/model.rs

src/config/model.rsView on unpkg · L59

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1410 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/services/telemetry_service.rsView file

11patternName = google_api_key severity = high line = 11 matchedText = .or_else...()))

High

Secret Pattern

Google API key in src/services/telemetry_service.rs

src/services/telemetry_service.rsView on unpkg · L11

Source & flagged code

7 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "@siranjeevan/gitnest",

3 "version": "1.0.1",

4 "description": "One Workspace. Multiple Git Identities.",

5 "main": "bin/gitnest.js",

6 "bin": {

7 "gitnest": "bin/gitnest.js"

8 },

9 "scripts": {

10 "postinstall": "node bin/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "repository": {

13 "type": "git",

14 "url": "git+https://github.com/siranjeevan/GitNest.git"

15 },

16 "keywords": [

17 "git",

18 "ssh",

19 "identity",

20 "cli",

21 "tui",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

22 "github"

23 ],

24 "author": "GitNest Team <smartjeevith2k@gmail.com>",

25 "license": "MIT",

26 "bugs": {

27 "url": "https://github.com/siranjeevan/GitNest/issues"

28 },

29 "homepage": "https://github.com/siranjeevan/GitNest#readme"

30}

src/config/model.rsView file

Lines 39-78rust

39 pub client_id: String,

40}

41

42impl Default for GitHubSettings {

43 fn default() -> Self {

44 Self {

45 client_id: "178c6fc778ccc68e1d6a".to_string(),

46 }

47 }

48}

49

50#[derive(Debug, Clone, Serialize, Deserialize)]

51pub struct FirebaseSettings {

52

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1410 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/services/telemetry_service.rsView file

Lines 1-31rust

1use chrono::Utc;

2use reqwest::Client;

3use serde_json::json;

4use sha2::Digest;

5use std::env;

6

7fn firebase_api_key() -> Option<String> {

8 let _ = dotenvy::dotenv();

9 env::var("FIREBASE_API_KEY")

10 .ok()

11 .or_else(|| Some("AIzaSyCjr1M0DW9TPwrKv_-LaGwq3Vvk5Ja0JJ4".to_string()))

High

Secret Pattern

Google API key in src/services/telemetry_service.rs

src/services/telemetry_service.rsView on unpkg · L11