gitelectron@1.0.14: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

gitelectron@1.0.14: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

2L3: const { spawn } = require('child_process') L4: const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L2

13const { execSync } = require('child_process') L14: execSync('npx electron-builder install-app-deps', { stdio: 'inherit' }) L15: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/postinstall.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.13 matchedPath = bin/postinstall.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.13 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5d47882827c7c488 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = gitelectron@1.0.13 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.13 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.jsView on unpkg

out/main/index.jsView file

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.13 matchedPath = out/main/index.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

out/main/index.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 7-47json

7 "out",

8 "bin"

9 ],

10 "bin": {

11 "gitelectron": "./bin/cli.js",

12 "gitquickpush": "./bin/cli.js"

13 },

14 "author": "GitElectron <support@gitelectron.com>",

15 "license": "MIT",

16 "homepage": "https://gitelectron.com",

17 "scripts": {

18 "release": "node release.js",

19 "format": "prettier --write .",

20 "lint": "eslint --cache .",

21 "typecheck:node": "tsc --noEmit -p tsconfig.node.json --composite false",

22 "typecheck:web": "tsc --noEmit -p tsconfig.web.json --composite false",

23 "typecheck": "npm run typecheck:node && npm run typecheck:web",

24 "start": "electron-vite preview",

25 "dev": "electron-vite dev",

26 "build": "npm run typecheck && electron-vite build",

27 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "build:unpack": "npm run build && electron-builder --dir",

29 "build:win": "npm run build && electron-builder --win",

30 "build:mac": "electron-vite build && electron-builder --mac",

31 "build:linux": "electron-vite build && electron-builder --linux"

32 },

33 "dependencies": {

34 "@electron-toolkit/preload": "^3.0.2",

35 "@electron-toolkit/utils": "^4.0.0",

36 "@google/generative-ai": "^0.24.1",

37 "@tailwindcss/postcss": "^4.3.3",

38 "autoprefixer": "^10.5.4",

39 "chokidar": "^5.0.0",

40 "commander": "^11.0.0",

41 "framer-motion": "^13.1.0",

42 "openai": "^7.5.0",

43 "postcss": "^8.5.26",

44 "qrcode.react": "^4.2.0",

45 "react-icons": "^5.7.0",

46 "simple-git": "^3.36.0",

47 "tailwindcss": "^4.3.3"

bin/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2

3const { spawn } = require('child_process')

4const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.js

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.13 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5d47882827c7c488 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = gitelectron@1.0.13 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.13 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.jsView on unpkg

out/main/index.jsView file

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.13 matchedPath = out/main/index.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

out/main/index.jsView on unpkg