Loading npm security reports…

gitxelectron@1.1.7: Malicious npm security report (Block) | LPM Firewall

registry / gitxelectron / 1.1.7

gitxelectron@1.1.7

An elegant, completely silent auto-syncing Git client. Works as a desktop app and npm CLI tool.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installation kills matching processes and globally installed copies launch an Electron application automatically. During AI recovery, the app transmits a GitHub token to Azure and the CLI executes AI-provided commands.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation, or an AI recovery path after a CLI push failure.

Impact

A GitHub credential is disclosed to a non-GitHub host and remote AI output can run shell commands in the user's repository.

Mechanism

Install hooks, token reuse with a third-party AI endpoint, and unvalidated AI command execution.

Attack narrative

The package automatically runs lifecycle hooks that kill application processes and, for global installs, launch an Electron application. Once authenticated, its AI recovery code uses the GitHub OAuth token as credentials for an Azure AI endpoint. The CLI then accepts commands returned by an AI service and executes them silently after a push error. This combines unconsented install behavior, credential disclosure, and remote command control.

AI rationale

Source code establishes credential exfiltration to an unrelated AI endpoint and execution of AI-supplied shell commands. These are concrete malicious behaviors, not necessary Git client functionality.

Evidence

package.jsonbin/preuninstall.jsbin/postinstall.jsbin/cli.jsout/main/index.js

Network endpoints1

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

2L3: const { spawn } = require('child_process') L4: const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L2

46const { execSync } = require('child_process'); L47: execSync(`powershell -NoProfile -Command "${psCommand}"`, { stdio: 'ignore' }); L48: console.log('✅ Desktop shortcut created successfully!');

High

Shell

Package source references shell execution.

bin/postinstall.jsView on unpkg · L46

13const { execSync } = require('child_process') L14: execSync('npx electron-builder install-app-deps', { stdio: 'inherit' }) L15: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/postinstall.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = gitxelectron@1.1.5 matchedPath = bin/postinstall.js matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitxelectron@1.1.5 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

out/main/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = gitxelectron@1.1.6 matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.1.6 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/main/index.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 8-48json

8 "bin"

9 ],

10 "bin": {

11 "gitxelectron": "bin/cli.js"

12 },

13 "author": "GitElectron <support@gitelectron.com>",

14 "license": "MIT",

15 "homepage": "https://gitelectron.com",

16 "scripts": {

17 "release": "node release.js",

18 "format": "prettier --write .",

19 "lint": "eslint --cache .",

20 "typecheck:node": "tsc --noEmit -p tsconfig.node.json --composite false",

21 "typecheck:web": "tsc --noEmit -p tsconfig.web.json --composite false",

22 "typecheck": "npm run typecheck:node && npm run typecheck:web",

23 "start": "electron-vite preview",

24 "dev": "electron-vite dev",

25 "build": "npm run typecheck && electron-vite build",

26 "preinstall": "node ./bin/preuninstall.js",

27 "preuninstall": "node ./bin/preuninstall.js",

28 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "build:unpack": "npm run build && electron-builder --dir",

30 "build:win": "npm run build && electron-builder --win",

31 "build:mac": "electron-vite build && electron-builder --mac",

32 "build:linux": "electron-vite build && electron-builder --linux"

33 },

34 "dependencies": {

35 "@electron-toolkit/preload": "^3.0.2",

36 "@electron-toolkit/utils": "^4.0.0",

37 "@google/generative-ai": "^0.24.1",

38 "@tailwindcss/postcss": "^4.3.3",

39 "autoprefixer": "^10.5.4",

40 "chokidar": "^5.0.0",

41 "commander": "^11.0.0",

42 "framer-motion": "^13.1.0",

43 "openai": "^7.5.0",

44 "postcss": "^8.5.26",

45 "qrcode.react": "^4.2.0",

46 "react-icons": "^5.7.0",

47 "simple-git": "^3.36.0",

48 "tailwindcss": "^4.3.3"

bin/postinstall.jsView file

Lines 1-58javascript

1#!/usr/bin/env node

2

3const { spawn } = require('child_process')

4const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.js

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitxelectron@1.1.5 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

out/main/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = gitxelectron@1.1.6 matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.1.6 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/main/index.jsView on unpkg