Loading npm security reports…

@siranjeevan/gitnest@1.0.3: Malicious npm security report (Block) | LPM Firewall

registry / @siranjeevan/gitnest / 1.0.3

@siranjeevan/gitnest@1.0.3

One Workspace. Multiple Git Identities.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Installation silently fetches an unverified native executable, which is later run by the CLI. After a user logs in, the Rust source transmits their GitHub username, email, OS, and architecture to Firestore despite no opt-in.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall; subsequently running gitnest and completing OAuth login

Impact

Remote release content can become executable; GitHub identity and device metadata are exfiltrated to a third-party Firestore project.

Mechanism

unchecked native payload installation plus undisclosed identity telemetry

Attack narrative

The postinstall hook downloads and extracts a native GitNest binary without checksum or signature verification, and the launcher executes it later. Independently, the login flow obtains GitHub identity data and unconditionally calls telemetry code that patches a Firestore users collection with the real GitHub username and email plus device metadata. This contradicts the package’s stated privacy claim and is not controlled by the configuration telemetry flag.

Rationale

Source establishes concrete undisclosed identity exfiltration and an unchecked install-time native-payload chain. These are sufficient for a malicious firewall verdict.

Evidence

package.jsonbin/install.jsbin/gitnest.jssrc/services/telemetry_service.rssrc/cli/handlers.rsREADME.mdvendor/gitnest

Network endpoints3

/siranjeevan/GitNest/releases/download/v1.0.3/

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node bin/install.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L4: const path = require('path'); L5: const https = require('https'); L6: const { execSync } = require('child_process'); ... L16: if (platform === 'darwin') { L17: artifactName = arch === 'arm64' ? `gitnest-v${VERSION}-macos-arm64.tar.gz` : `gitnest-v${VERSION}-macos-x86_64.tar.gz`; L18: } else if (platform === 'linux') { L19: if (arch === 'x64') { L20: artifactName = `gitnest-v${VERSION}-linux-x86_64.tar.gz`; L21: } else { ... L31: L32: const downloadUrl = `https://github.com/${REPO}/releases/download/v${VERSION}/${artifactName}`; L33: const binDir = path.join(__dirname, '..', 'vendor');

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

•scripts.postinstall = node bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/config/model.rsView file

59patternName = google_api_key severity = high line = 59 matchedText = api_key:...g(),

High

High Secret

Package contains a high-severity secret pattern.

src/config/model.rsView on unpkg · L59

59patternName = google_api_key severity = high line = 59 matchedText = api_key:...g(),

High

Secret Pattern

Google API key in src/config/model.rs

src/config/model.rsView on unpkg · L59

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1410 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

bin/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @siranjeevan/gitnest@1.0.1 matchedIdentity = npm:QHNpcmFuamVldmFuL2dpdG5lc3Q:1.0.1 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/install.jsView on unpkg

src/services/telemetry_service.rsView file

11patternName = google_api_key severity = high line = 11 matchedText = .or_else...()))

High

Secret Pattern

Google API key in src/services/telemetry_service.rs

src/services/telemetry_service.rsView on unpkg · L11

Source & flagged code

8 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "@siranjeevan/gitnest",

3 "version": "1.0.3",

4 "description": "One Workspace. Multiple Git Identities.",

5 "main": "bin/gitnest.js",

6 "bin": {

7 "gitnest": "bin/gitnest.js"

8 },

9 "scripts": {

10 "postinstall": "node bin/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "repository": {

13 "type": "git",

14 "url": "git+https://github.com/siranjeevan/GitNest.git"

15 },

16 "keywords": [

17 "git",

18 "ssh",

19 "identity",

20 "cli",

21 "tui",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

22 "github"

23 ],

24 "author": "GitNest Team <smartjeevith2k@gmail.com>",

25 "license": "MIT",

26 "bugs": {

27 "url": "https://github.com/siranjeevan/GitNest/issues"

28 },

29 "homepage": "https://github.com/siranjeevan/GitNest#readme"

30}

src/config/model.rsView file

Lines 39-78rust

39 pub client_id: String,

40}

41

42impl Default for GitHubSettings {

43 fn default() -> Self {

44 Self {

45 client_id: "178c6fc778ccc68e1d6a".to_string(),

46 }

47 }

48}

49

50#[derive(Debug, Clone, Serialize, Deserialize)]

51pub struct FirebaseSettings {

52

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1410 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

bin/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @siranjeevan/gitnest@1.0.1 matchedIdentity = npm:QHNpcmFuamVldmFuL2dpdG5lc3Q:1.0.1 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/install.jsView on unpkg

src/services/telemetry_service.rsView file

Lines 1-31rust

1use chrono::Utc;

2use reqwest::Client;

3use serde_json::json;

4use sha2::Digest;

5use std::env;

6

7fn firebase_api_key() -> Option<String> {

8 let _ = dotenvy::dotenv();

9 env::var("FIREBASE_API_KEY")

10 .ok()

11 .or_else(|| Some("AIzaSyCjr1M0DW9TPwrKv_-LaGwq3Vvk5Ja0JJ4".to_string()))

High

Secret Pattern

Google API key in src/services/telemetry_service.rs

src/services/telemetry_service.rsView on unpkg · L11