Loading npm security reports…

gitxelectron@1.2.1: Malicious npm security report (Block) | LPM Firewall

registry / gitxelectron / 1.2.1

gitxelectron@1.2.1

An elegant, completely silent auto-syncing Git client. Works as a desktop app and npm CLI tool.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

A failed CLI Git push sends repository status and error text to an external AI service, then shell-executes its returned commands. The desktop AI path also transmits a stored GitHub token to an Azure AI endpoint.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Run the CLI push command and encounter an error, or invoke the desktop AI repair feature.

Impact

A remote service or compromised model response can run arbitrary local commands; a GitHub access token is disclosed to an unrelated endpoint.

Mechanism

External AI response execution and GitHub token disclosure.

Attack narrative

During CLI error recovery, the package sends Git state and an error to a remote AI provider and passes every returned command directly to shell execution. In the desktop path, it retrieves the locally stored GitHub OAuth token and uses that token as the API credential for an Azure AI service. Its update handler also launches a detached command shell that globally installs this and another package. These are concrete remote-command and credential-disclosure paths, not required Git client behavior.

AI rationale

The package combines external AI-controlled command execution with disclosure of a GitHub token to a non-GitHub endpoint. Install hooks and a detached global updater further expand the unconsented execution surface.

Evidence

package.jsonbin/cli.jsout/main/index.js

Network endpoints2

router.huggingface.co/v1

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

2L3: const { spawn } = require('child_process') L4: const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L2

46const { execSync } = require('child_process'); L47: execSync(`powershell -NoProfile -Command "${psCommand}"`, { stdio: 'ignore' }); L48: console.log('✅ Desktop shortcut created successfully!');

High

Shell

Package source references shell execution.

bin/postinstall.jsView on unpkg · L46

13const { execSync } = require('child_process') L14: execSync('npx electron-builder install-app-deps', { stdio: 'inherit' }) L15: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/postinstall.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = gitxelectron@1.1.7 matchedPath = bin/postinstall.js matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

out/main/index.jsView file

37const decrypted = electron.safeStorage.decryptString(encrypted); L38: accounts = JSON.parse(decrypted); L39: } ... L116: async function startDeviceFlow(_sessionId) { L117: const response = await fetch("https://github.com/login/device/code", { L118: method: "POST", ... L122: }, L123: body: JSON.stringify({ L124: client_id: GITHUB_CLIENT_ID, ... L360: } L361: async function createGitHubRepository(sessionId, name, description, isPrivate, autoInit = false, gitignoreTemplate = "", licenseTemplate = "") { L362: const token = getToken(sessionId);

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

out/main/index.jsView on unpkg · L37

37Trigger-reachable chain: manifest.main -> out/main/index.js L37: const decrypted = electron.safeStorage.decryptString(encrypted); L38: accounts = JSON.parse(decrypted); L39: } ... L116: async function startDeviceFlow(_sessionId) { L117: const response = await fetch("https://github.com/login/device/code", { L118: method: "POST", ... L122: }, L123: body: JSON.stringify({ L124: client_id: GITHUB_CLIENT_ID, ... L360: } L361: async function createGitHubRepository(sessionId, name, description, isPrivate, autoInit = false, gitignoreTemplate = "", licenseTemplate = "") { L362: const token = getToken(sessionId);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

out/main/index.jsView on unpkg · L37

•matchType = previous_version_dangerous_delta matchedPackage = gitxelectron@1.1.6 matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.1.6 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitxelectron@1.1.7 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 8-48json

8 "bin"

9 ],

10 "bin": {

11 "gitxelectron": "bin/cli.js"

12 },

13 "author": "GitElectron <support@gitelectron.com>",

14 "license": "MIT",

15 "homepage": "https://gitelectron.com",

16 "scripts": {

17 "release": "node release.js",

18 "format": "prettier --write .",

19 "lint": "eslint --cache .",

20 "typecheck:node": "tsc --noEmit -p tsconfig.node.json --composite false",

21 "typecheck:web": "tsc --noEmit -p tsconfig.web.json --composite false",

22 "typecheck": "npm run typecheck:node && npm run typecheck:web",

23 "start": "electron-vite preview",

24 "dev": "electron-vite dev",

25 "build": "npm run typecheck && electron-vite build",

26 "preinstall": "node ./bin/preuninstall.js",

27 "preuninstall": "node ./bin/preuninstall.js",

28 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "build:unpack": "npm run build && electron-builder --dir",

30 "build:win": "npm run build && electron-builder --win",

31 "build:mac": "electron-vite build && electron-builder --mac",

32 "build:linux": "electron-vite build && electron-builder --linux"

33 },

34 "dependencies": {

35 "@electron-toolkit/preload": "^3.0.2",

36 "@electron-toolkit/utils": "^4.0.0",

37 "@google/generative-ai": "^0.24.1",

38 "@tailwindcss/postcss": "^4.3.3",

39 "autoprefixer": "^10.5.4",

40 "chokidar": "^5.0.0",

41 "commander": "^11.0.0",

42 "framer-motion": "^13.1.0",

43 "openai": "^7.5.0",

44 "postcss": "^8.5.26",

45 "qrcode.react": "^4.2.0",

46 "react-icons": "^5.7.0",

47 "simple-git": "^3.36.0",

48 "tailwindcss": "^4.3.3"

bin/postinstall.jsView file

Lines 1-58javascript

1#!/usr/bin/env node

2

3const { spawn } = require('child_process')

4const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.js

out/main/index.jsView file

Lines 17-57javascript

17 Object.defineProperty(n, k, d.get ? d : {

18 enumerable: true,

19 get: () => e[k]

20 });

21 }

22 }

23 }

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitxelectron@1.1.7 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg