registry / Install hook abuse / gitxelectron / 1.2.8

gitxelectron@1.2.8

An elegant, completely silent auto-syncing Git client. Works as a desktop app and npm CLI tool.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Install hooks kill processes and can auto-launch a GitHub login window, and the CLI executes unsanitized model-generated shell commands. No hidden attacker inbox for tokens was found, so this is dangerous dual-use install and runtime behavior rather than a proven steal-and-exfil implant.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of gitxelectron, especially npm install -g; later gitxelectron push or an in-app update click.

Impact

Local processes can be force-killed, the user can be prompted for GitHub OAuth at install time, the CLI can run arbitrary shell from model output, and other global packages can be installed on update.

Mechanism

Lifecycle process kill and GUI launch, unsanitized AI shell execution, and global install of other packages

AI rationale

Evidence

package.jsonbin/preuninstall.jsbin/postinstall.jsbin/cli.jsout/main/index.jsDesktop/GitElectron.lnk~/.gitelectron-cli-config.json

Network endpoints6

github.com/login/device/codegithub.com/login/oauth/access_tokenapi.github.commodels.inference.ai.azure.comrouter.huggingface.co/v1registry.npmjs.org/gitelectron/latest

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json registers preinstall, postinstall, and preuninstall scripts that run on npm install and uninstall.
preinstall and preuninstall force-kill processes named GitElectron via taskkill or pkill.
On a global install, postinstall launches the Electron app for GitHub login and may drop a Windows desktop shortcut.
The gitxelectron push CLI runs unsanitized model-generated shell commands with execSync when a push fails.
The in-app updater globally installs gitelectron@latest and gitquickpush-cli@latest, which are different package names.
Saved GitHub OAuth tokens are sent as API keys to models.inference.ai.azure.com during AI helper calls.

Evidence against

GitHub login and repo calls go to github.com and api.github.com device-flow and API endpoints, not a hidden command-and-control host.
Account tokens are stored with Electron safeStorage; the Azure models host is GitHub Models-style token auth rather than a random dump URL.
The published tree is a real Electron Git client (simple-git, chokidar, React UI) and does not talk to this review or claim to be a scanner fixture.
package.json does not runtime-depend on gitxelectron itself, so the nested lifecycle self-dependency chain is not present.

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

2L3: const { spawn } = require('child_process') L4: const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L2

46const { execSync } = require('child_process'); L47: execSync(`powershell -NoProfile -Command "${psCommand}"`, { stdio: 'ignore' }); L48: console.log('✅ Desktop shortcut created successfully!');

High

Shell

Package source references shell execution.

bin/postinstall.jsView on unpkg · L46

13const { execSync } = require('child_process') L14: execSync('npx electron-builder install-app-deps', { stdio: 'inherit' }) L15: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/postinstall.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = gitxelectron@1.2.1 matchedPath = bin/postinstall.js matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

out/main/index.jsView file

6const crypto = require("crypto"); L7: const child_process = require("child_process"); L8: const readline = require("readline"); ... L40: const decrypted = electron.safeStorage.decryptString(encrypted); L41: accounts = JSON.parse(decrypted); L42: } ... L119: async function startDeviceFlow(_sessionId) { L120: const response = await fetch("https://github.com/login/device/code", { L121: method: "POST", ... L125: }, L126: body: JSON.stringify({ L127: client_id: GITHUB_CLIENT_ID,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

out/main/index.jsView on unpkg · L6

Critical

Download Execute

Source downloads or fetches remote code and executes it.

out/main/index.jsView on unpkg · L6

6Trigger-reachable chain: manifest.main -> out/main/index.js L6: const crypto = require("crypto"); L7: const child_process = require("child_process"); L8: const readline = require("readline"); ... L40: const decrypted = electron.safeStorage.decryptString(encrypted); L41: accounts = JSON.parse(decrypted); L42: } ... L119: async function startDeviceFlow(_sessionId) { L120: const response = await fetch("https://github.com/login/device/code", { L121: method: "POST", ... L125: }, L126: body: JSON.stringify({ L127: client_id: GITHUB_CLIENT_ID,

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = gitxelectron@1.2.1 matchedPath = bin/cli.js matchedIdentity = npm:Z2l0eGVsZWN0cm9u:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

2L3: const { spawn } = require('child_process') L4: const path = require('path')

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L2

Findings

3 Critical7 High4 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationout/main/index.js

CriticalDownload Executeout/main/index.js

CriticalTrigger Reachable Dangerous Capabilityout/main/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/postinstall.js

HighShellbin/postinstall.js

HighCredential Redirect Persistenceout/main/index.js

HighRuntime Package Installbin/postinstall.js

HighKnown Malware Source Similaritybin/cli.js

HighKnown Malware Source Similaritybin/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

Affected versions and remediation

This report applies to gitxelectron@1.2.8.

See all versions of gitxelectron for other recorded verdicts.

Review the evidence and your use of gitxelectron@1.2.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-18 21:47:32.176Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code