gitxelectron@1.3.5
An elegant, completely silent auto-syncing Git client. Works as a desktop app and npm CLI tool.
AI Security Review
scanned 25d ago · by lpm-firewall-aiUnvalidated AI-produced shell commands are a concrete remote-code-execution risk. The evidence supports a dangerous capability warning rather than a confirmed malicious payload block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the push command and its Git operation fails.
Impact
A manipulated or unsafe AI response can run arbitrary commands with the invoking user's permissions.
Mechanism
The CLI requests an AI response and passes each returned commandsToRun value directly to execSync without an allowlist, parsing guard, or user approval.
AI rationale
Unvalidated AI-produced shell commands are a concrete remote-code-execution risk. The evidence supports a dangerous capability warning rather than a confirmed malicious payload block.
Evidence
bin/cli.jspackage.jsonbin/postinstall.jsout/main/index.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest runs both preinstall and postinstall scripts automatically.
- Global installation launches a detached Electron application during postinstall.
- The push error path sends Git status and error data to an AI provider, then executes every returned command without validation.
- The desktop update handler installs the package and another package globally through cmd.exe.
Evidence against
- No code inspected showed credential collection sent to an unrelated endpoint.
- The automatic command path is reached after a user invokes the push command and it encounters an error.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/postinstall.jsView file
2L3: const { spawn } = require('child_process')
L4: const path = require('path')
High
46
Findings
3 Critical6 High4 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationout/main/index.js
CriticalDownload Executeout/main/index.js
CriticalTrigger Reachable Dangerous Capabilityout/main/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/postinstall.js
HighShellbin/postinstall.js
HighRuntime Package Installbin/postinstall.js
HighKnown Malware Source Similaritybin/cli.js
HighKnown Malware Source Similaritybin/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to gitxelectron@1.3.5.
See all versions of gitxelectron for other recorded verdicts.
- Review the evidence and your use of gitxelectron@1.3.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.