registry / Remote code execution / gitelectron / 1.0.17

gitelectron@1.0.17

An elegant, completely silent auto-syncing Git client. Works as a desktop app and npm CLI tool.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a real Electron Git client, but install hooks auto-launch OAuth, default auto-sync silently pushes repos, and the CLI runs hidden shell commands from a remote model. That is dangerous dual-use capability without a proven third-party exfil channel, so it warrants a warning rather than a clean or block decision.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install, especially npm install -g, then GitHub device-flow consent, gitelectron push, auto-sync, or the in-app update action.

Impact

A user who authorizes GitHub grants repo-scoped access to this app; watched repos can be committed and pushed without a further prompt; arbitrary commands from the model run with the user's privileges.

Mechanism

Install-time app launch plus unsanitized model-returned shell execution and silent git auto-push

AI rationale

Evidence

package.jsonbin/postinstall.jsbin/preuninstall.jsbin/cli.jsout/main/index.jsDesktop/GitElectron.lnk~/.gitelectron-cli-config.jsongithub_accounts.enc

Network endpoints6

github.com/login/device/codegithub.com/login/oauth/access_tokenapi.github.comregistry.npmjs.org/gitelectron/latestmodels.inference.ai.azure.comrouter.huggingface.co/v1

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Install scripts auto-launch the Electron app on global install, create a Desktop shortcut, and force-kill processes matching GitElectron.
The CLI silently runs unsanitized shell commands returned by a remote model when a push fails.
GitHub device-flow login requests repo and user scopes and stores access tokens locally.
Auto-sync is treated as on unless turned off and silently commits then pushes watched files.
The in-app updater writes a temp script that globally installs gitelectron@latest and gitquickpush-cli@latest.

Evidence against

Network use is GitHub, the npm registry, Hugging Face, and Azure GitHub Models, not a hidden collector host.
GitHub tokens are encrypted with Electron safeStorage and are not posted to a third-party endpoint in this source.
The tree is a full Electron Git client with UI, OAuth, and git helpers matching that product, not an obfuscated dropper.
There is no package.json self-dependency and no writes to foreign AI-agent config surfaces.

Behavioral surface

Source

ChildProcess

Source & flagged code

8 flagged

package.jsonView file

Lines 9-49json

9 ],

10 "bin": {

11 "gitelectron": "./bin/cli.js",

12 "gitquickpush": "./bin/cli.js"

13 },

14 "author": "GitElectron <support@gitelectron.com>",

15 "license": "MIT",

16 "homepage": "https://gitelectron.com",

17 "scripts": {

18 "release": "node release.js",

19 "format": "prettier --write .",

20 "lint": "eslint --cache .",

21 "typecheck:node": "tsc --noEmit -p tsconfig.node.json --composite false",

22 "typecheck:web": "tsc --noEmit -p tsconfig.web.json --composite false",

23 "typecheck": "npm run typecheck:node && npm run typecheck:web",

24 "start": "electron-vite preview",

25 "dev": "electron-vite dev",

26 "build": "npm run typecheck && electron-vite build",

27 "preinstall": "node ./bin/preuninstall.js",

28 "preuninstall": "node ./bin/preuninstall.js",

29 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "build:unpack": "npm run build && electron-builder --dir",

31 "build:win": "npm run build && electron-builder --win",

32 "build:mac": "electron-vite build && electron-builder --mac",

33 "build:linux": "electron-vite build && electron-builder --linux"

34 },

35 "dependencies": {

36 "@electron-toolkit/preload": "^3.0.2",

37 "@electron-toolkit/utils": "^4.0.0",

38 "@google/generative-ai": "^0.24.1",

39 "@tailwindcss/postcss": "^4.3.3",

40 "autoprefixer": "^10.5.4",

41 "chokidar": "^5.0.0",

42 "commander": "^11.0.0",

43 "framer-motion": "^13.1.0",

44 "openai": "^7.5.0",

45 "postcss": "^8.5.26",

46 "qrcode.react": "^4.2.0",

47 "react-icons": "^5.7.0",

48 "simple-git": "^3.36.0",

49 "tailwindcss": "^4.3.3"

bin/postinstall.jsView file

Lines 1-58javascript

1#!/usr/bin/env node

3const { spawn } = require('child_process')

4const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.js

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitxelectron@1.2.1 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

out/main/index.jsView file

•matchType = normalized_sha256 matchedPackage = gitelectron@1.0.16 matchedPath = out/main/index.js matchedIdentity = npm:Z2l0ZWxlY3Ryb24:1.0.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

out/main/index.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

2L3: const { spawn } = require('child_process') L4: const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L2

Findings

7 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/postinstall.js

HighShellbin/postinstall.js

HighRuntime Package Installbin/postinstall.js

HighKnown Malware Source Similaritybin/cli.js

HighKnown Malware Source Similaritybin/postinstall.js

HighKnown Malware Source Similarityout/main/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to gitelectron@1.0.17.

See all versions of gitelectron for other recorded verdicts.

Review the evidence and your use of gitelectron@1.0.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 03:58:32.046Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.