gitelectron@1.0.12
An elegant, completely silent auto-syncing Git client. Works as a desktop app and npm CLI tool.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a real Electron Git client, but it still has dangerous dual-use behavior: a postinstall hook that launches setup, unconstrained execSync of AI-returned commands, and a global install of gitquickpush-cli on update. There is no third-party token drop or the full obfuscated self-dependency install chain, so this is a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm install (postinstall); gitelectron push after a git error; in-app install-update.
Impact
Arbitrary local commands can run from model output. A user-triggered update can globally install another npm package. Completing GitHub device login grants repo-scoped access stored on disk.
Mechanism
install-time process spawn plus unconstrained AI command execution
AI rationale
This is a real Electron Git client, but it still has dangerous dual-use behavior: a postinstall hook that launches setup, unconstrained execSync of AI-returned commands, and a global install of gitquickpush-cli on update. There is no third-party token drop or the full obfuscated self-dependency install chain, so this is a warning rather than a publish block.
Evidence
package.jsonbin/postinstall.jsbin/cli.jsout/main/index.js.gitelectron-cli-config.jsongithub_accounts.enc
Network endpoints6
github.com/login/device/codegithub.com/login/oauth/access_tokenapi.github.commodels.inference.ai.azure.comrouter.huggingface.co/v1registry.npmjs.org/gitelectron/latest
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- postinstall runs npx electron-builder on local installs and, on global installs, tries to launch Electron for GitHub login.
- The CLI runs every command string returned by the AI fixer through execSync with no allowlist.
- Gemini API keys are hardcoded as fallbacks in the CLI and desktop main process.
- The in-app updater runs npm i -g gitelectron@latest gitquickpush-cli@latest.
- Auto-sync is on unless locally disabled and will stage, commit, and push watched files.
- GitHub device-flow login requests repo and user scopes and stores access tokens locally.
Evidence against
- GitHub tokens are used against GitHub and Azure inference APIs and stored with Electron safeStorage when available; no third-party drop host appears.
- Electron is only a devDependency, so the global postinstall auto-launch usually exits after a missing-binary check.
- Source is readable Electron/React/CLI code with no obfuscation, eval, or AI-agent config writes.
- package.json does not declare a runtime self-dependency that would nest another install lifecycle.
- Auto-sync and the updater run only after the desktop app is launched and the user opens a repo or clicks update.
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/postinstall.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = gitelectron@1.0.17
matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.17
similarity = 0.600
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/postinstall.jsFindings
1 Critical9 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltabin/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/postinstall.js
HighShell
HighSandbox Evasion Gated Capabilityout/main/index.js
HighRuntime Package Installbin/postinstall.js
HighKnown Malware Source Similaritybin/cli.js
HighKnown Malware Source Similarityout/main/index.js
HighKnown Malware Source Similaritybin/postinstall.js
HighKnown Malware Source Fingerprint Signaturebin/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
Affected versions and remediation
This report applies to gitelectron@1.0.12.
See all versions of gitelectron for other recorded verdicts.
- Review the evidence and your use of gitelectron@1.0.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.