gitelectron@1.0.11: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

gitelectron@1.0.11: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

2L3: const { spawn } = require('child_process') L4: const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L2

13const { execSync } = require('child_process') L14: execSync('npx electron-builder install-app-deps', { stdio: 'inherit' }) L15: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/postinstall.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.10 matchedPath = bin/postinstall.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

out/main/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = gitelectron@1.0.7 matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.7 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/main/index.jsView on unpkg

37const decrypted = electron.safeStorage.decryptString(encrypted); L38: accounts = JSON.parse(decrypted); L39: } ... L108: async function startDeviceFlow(_sessionId) { L109: const response = await fetch("https://github.com/login/device/code", { L110: method: "POST", ... L114: }, L115: body: JSON.stringify({ L116: client_id: GITHUB_CLIENT_ID, ... L262: } L263: async function createGitHubRepository(sessionId, name, description, isPrivate, autoInit = false, gitignoreTemplate = "", licenseTemplate = "") { L264: const token = getToken(sessionId);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

out/main/index.jsView on unpkg · L37

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.10 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 7-47json

7 "out",

8 "bin"

9 ],

10 "bin": {

11 "gitelectron": "./bin/cli.js",

12 "gitquickpush": "./bin/cli.js"

13 },

14 "author": "GitElectron <support@gitelectron.com>",

15 "license": "MIT",

16 "homepage": "https://gitelectron.com",

17 "scripts": {

18 "release": "node release.js",

19 "format": "prettier --write .",

20 "lint": "eslint --cache .",

21 "typecheck:node": "tsc --noEmit -p tsconfig.node.json --composite false",

22 "typecheck:web": "tsc --noEmit -p tsconfig.web.json --composite false",

23 "typecheck": "npm run typecheck:node && npm run typecheck:web",

24 "start": "electron-vite preview",

25 "dev": "electron-vite dev",

26 "build": "npm run typecheck && electron-vite build",

27 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "build:unpack": "npm run build && electron-builder --dir",

29 "build:win": "npm run build && electron-builder --win",

30 "build:mac": "electron-vite build && electron-builder --mac",

31 "build:linux": "electron-vite build && electron-builder --linux"

32 },

33 "dependencies": {

34 "@electron-toolkit/preload": "^3.0.2",

35 "@electron-toolkit/utils": "^4.0.0",

36 "@google/generative-ai": "^0.24.1",

37 "@tailwindcss/postcss": "^4.3.3",

38 "autoprefixer": "^10.5.4",

39 "chokidar": "^5.0.0",

40 "commander": "^11.0.0",

41 "framer-motion": "^13.1.0",

42 "openai": "^7.5.0",

43 "postcss": "^8.5.26",

44 "qrcode.react": "^4.2.0",

45 "react-icons": "^5.7.0",

46 "simple-git": "^3.36.0",

47 "tailwindcss": "^4.3.3"

bin/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2

3const { spawn } = require('child_process')

4const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.js

out/main/index.jsView file

Lines 17-57javascript

17 Object.defineProperty(n, k, d.get ? d : {

18 enumerable: true,

19 get: () => e[k]

20 });

21 }

22 }

23 }

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.10 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg