registry / gitelectron / 1.0.7

gitelectron@1.0.7

An elegant, completely silent auto-syncing Git client. Works as a desktop app and npm CLI tool.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The user-invoked CLI auto-heal path accepts commands from a remote AI response and executes them with `execSync`. This is a concrete arbitrary-command-execution risk, not evidence of package-authored malware.

Static reason

One or more suspicious static signals were detected.

Trigger

Run `gitelectron push` and cause a Git error that enters AI Auto-Heal.

Impact

A compromised, malicious, or prompt-injected model response can execute arbitrary commands as the CLI user.

Mechanism

Unvalidated remote AI command list passed to shell execution.

Rationale

Source establishes an unvalidated remote-AI-to-shell execution chain, which is a serious dangerous capability. It is user-invoked and feature-associated rather than covert install-time malware, so warning is appropriate.

Evidence

bin/cli.jssrc/main/aiService.tsbin/postinstall.jspackage.json~/.gitelectron-cli-config.jsonuser-selected Git repository

Network endpoints1

router.huggingface.co/v1

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Critical Vulnerability with false-positive risk.

gitelectron@1.0.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code