Loading npm security reports…

gitelectron@1.0.16: Malicious npm security report (Block) | LPM Firewall

registry / gitelectron / 1.0.16

gitelectron@1.0.16

An elegant, completely silent auto-syncing Git client. Works as a desktop app and npm CLI tool.

AI Security Review

scanned 53m ago · by lpm-firewall-ai

A failed user-invoked CLI push sends repository status and an error message to an AI service, then runs the service's returned shell commands. Installation also executes an npx command and can launch the desktop application.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Run the push command and cause a Git error; install the package.

Impact

A compromised, malicious, or prompt-injected AI response can execute arbitrary commands with the user's privileges and receive repository metadata.

Mechanism

Unvalidated remote AI command execution and install-time process launch.

Attack narrative

When the push command fails, the CLI serializes Git status and the error message into an AI prompt. It accepts the returned commands and passes each directly to execSync without an allowlist, confirmation, or sandbox. Repository-controlled content or a compromised AI endpoint can therefore turn a routine Git error into arbitrary local command execution. The install hook independently runs npx and may launch a detached GUI process.

Rationale

The package contains a concrete arbitrary-command execution path fed by a remote AI response, plus intrusive lifecycle behavior. This exceeds normal Git-client functionality and creates a practical remote code execution risk.

Evidence

package.jsonbin/cli.jsbin/postinstall.jsbin/preuninstall.jsout/main/index.js

Network endpoints2

router.huggingface.co/v1

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

2L3: const { spawn } = require('child_process') L4: const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L2

46const { execSync } = require('child_process'); L47: execSync(`powershell -NoProfile -Command "${psCommand}"`, { stdio: 'ignore' }); L48: console.log('✅ Desktop shortcut created successfully!');

High

Shell

Package source references shell execution.

bin/postinstall.jsView on unpkg · L46

13const { execSync } = require('child_process') L14: execSync('npx electron-builder install-app-deps', { stdio: 'inherit' }) L15: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/postinstall.jsView on unpkg · L13

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.13 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

out/main/index.jsView file

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.13 matchedPath = out/main/index.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

out/main/index.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 9-49json

9 ],

10 "bin": {

11 "gitelectron": "./bin/cli.js",

12 "gitquickpush": "./bin/cli.js"

13 },

14 "author": "GitElectron <support@gitelectron.com>",

15 "license": "MIT",

16 "homepage": "https://gitelectron.com",

17 "scripts": {

18 "release": "node release.js",

19 "format": "prettier --write .",

20 "lint": "eslint --cache .",

21 "typecheck:node": "tsc --noEmit -p tsconfig.node.json --composite false",

22 "typecheck:web": "tsc --noEmit -p tsconfig.web.json --composite false",

23 "typecheck": "npm run typecheck:node && npm run typecheck:web",

24 "start": "electron-vite preview",

25 "dev": "electron-vite dev",

26 "build": "npm run typecheck && electron-vite build",

27 "preinstall": "node ./bin/preuninstall.js",

28 "preuninstall": "node ./bin/preuninstall.js",

29 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "build:unpack": "npm run build && electron-builder --dir",

31 "build:win": "npm run build && electron-builder --win",

32 "build:mac": "electron-vite build && electron-builder --mac",

33 "build:linux": "electron-vite build && electron-builder --linux"

34 },

35 "dependencies": {

36 "@electron-toolkit/preload": "^3.0.2",

37 "@electron-toolkit/utils": "^4.0.0",

38 "@google/generative-ai": "^0.24.1",

39 "@tailwindcss/postcss": "^4.3.3",

40 "autoprefixer": "^10.5.4",

41 "chokidar": "^5.0.0",

42 "commander": "^11.0.0",

43 "framer-motion": "^13.1.0",

44 "openai": "^7.5.0",

45 "postcss": "^8.5.26",

46 "qrcode.react": "^4.2.0",

47 "react-icons": "^5.7.0",

48 "simple-git": "^3.36.0",

49 "tailwindcss": "^4.3.3"

bin/postinstall.jsView file

Lines 1-58javascript

1#!/usr/bin/env node

2

3const { spawn } = require('child_process')

4const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.js

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.13 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

out/main/index.jsView file

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.13 matchedPath = out/main/index.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

out/main/index.jsView on unpkg