Loading npm security reports…

gitelectron@1.0.10: Malicious npm security report (Block) | LPM Firewall

registry / gitelectron / 1.0.10

gitelectron@1.0.10

An elegant, completely silent auto-syncing Git client. Works as a desktop app and npm CLI tool.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Global installation can launch an authentication app. During a failed CLI push, remote model output is executed as shell commands, and the desktop AI feature sends the GitHub token and repository diagnostics to external model services.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Global npm installation, or a failed gitelectron push followed by AI auto-healing.

Impact

An attacker controlling or influencing the AI response can run commands in the user's project context; GitHub credentials and repository metadata can be disclosed to external services.

Mechanism

Unattended app launch, remote-command execution, and token reuse for remote AI requests.

Attack narrative

On global installation, the lifecycle hook starts the desktop application and initiates GitHub authentication. If the user runs the CLI push command and it fails, the package sends Git diagnostics to an AI service, then passes every returned command directly to shell execution. The desktop path also supplies the stored GitHub token as the API key to an Azure model endpoint. These are concrete credential-disclosure and remote-command-execution behaviors, not merely static capability indicators.

Rationale

The package combines unconsented install-time authentication prompting with execution of remotely generated commands and reuse of a GitHub token at a third-party model endpoint. These behaviors create concrete credential-exfiltration and command-execution risk.

Evidence

bin/postinstall.jsbin/cli.jsout/main/index.js.gitelectron-cli-config.jsongithub_accounts.enc

Network endpoints2

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

2L3: const { spawn } = require('child_process') L4: const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L2

13const { execSync } = require('child_process') L14: execSync('npx electron-builder install-app-deps', { stdio: 'inherit' }) L15: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/postinstall.jsView on unpkg · L13

out/main/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = gitelectron@1.0.7 matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.7 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/main/index.jsView on unpkg

37const decrypted = electron.safeStorage.decryptString(encrypted); L38: accounts = JSON.parse(decrypted); L39: } ... L108: async function startDeviceFlow(_sessionId) { L109: const response = await fetch("https://github.com/login/device/code", { L110: method: "POST", ... L114: }, L115: body: JSON.stringify({ L116: client_id: GITHUB_CLIENT_ID, ... L262: } L263: async function createGitHubRepository(sessionId, name, description, isPrivate, autoInit = false, gitignoreTemplate = "", licenseTemplate = "") { L264: const token = getToken(sessionId);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

out/main/index.jsView on unpkg · L37

Source & flagged code

6 flagged

package.jsonView file

Lines 7-47json

7 "out",

8 "bin"

9 ],

10 "bin": {

11 "gitelectron": "./bin/cli.js",

12 "gitquickpush": "./bin/cli.js"

13 },

14 "author": "GitElectron <support@gitelectron.com>",

15 "license": "MIT",

16 "homepage": "https://gitelectron.com",

17 "scripts": {

18 "release": "node release.js",

19 "format": "prettier --write .",

20 "lint": "eslint --cache .",

21 "typecheck:node": "tsc --noEmit -p tsconfig.node.json --composite false",

22 "typecheck:web": "tsc --noEmit -p tsconfig.web.json --composite false",

23 "typecheck": "npm run typecheck:node && npm run typecheck:web",

24 "start": "electron-vite preview",

25 "dev": "electron-vite dev",

26 "build": "npm run typecheck && electron-vite build",

27 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "build:unpack": "npm run build && electron-builder --dir",

29 "build:win": "npm run build && electron-builder --win",

30 "build:mac": "electron-vite build && electron-builder --mac",

31 "build:linux": "electron-vite build && electron-builder --linux"

32 },

33 "dependencies": {

34 "@electron-toolkit/preload": "^3.0.2",

35 "@electron-toolkit/utils": "^4.0.0",

36 "@google/generative-ai": "^0.24.1",

37 "@tailwindcss/postcss": "^4.3.3",

38 "autoprefixer": "^10.5.4",

39 "chokidar": "^5.0.0",

40 "commander": "^11.0.0",

41 "framer-motion": "^13.1.0",

42 "openai": "^7.5.0",

43 "postcss": "^8.5.26",

44 "qrcode.react": "^4.2.0",

45 "react-icons": "^5.7.0",

46 "simple-git": "^3.36.0",

47 "tailwindcss": "^4.3.3"

bin/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2

3const { spawn } = require('child_process')

4const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.js

out/main/index.jsView file

Lines 17-57javascript

17 Object.defineProperty(n, k, d.get ? d : {

18 enumerable: true,

19 get: () => e[k]

20 });

21 }

22 }

23 }