registry / zen-gitsync / 2.15.2

zen-gitsync@2.15.2

Auto commit, scheduled sync, and visual GUI for Git. Run `g` in any repo for one-key commit & push, AI commit messages, scheduled background sync, and a drag-and-drop workflow builder.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time behavior was found. The package does expose powerful local GUI/CLI automation surfaces, including arbitrary command execution and Claude Code execution with skipped permissions, so it is risky if exposed to an untrusted local browser context.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs g, g ui, npm run release, or calls local GUI API routes.

Impact

Can run commands, edit project files, perform git/npm operations, and invoke Claude Code when the local UI or CLI is used.

Mechanism

user-invoked local git/terminal/AI automation

Rationale

Static source inspection shows a git-sync developer tool with dangerous user-invoked local automation, not covert lifecycle execution, credential theft, or hidden exfiltration. Because the local GUI exposes command and AI-agent execution surfaces, warn rather than block.

Evidence

package.jsonindex.jssrc/gitCommit.jssrc/cli/customCommand.jssrc/ui/server/index.jssrc/ui/server/routes/exec.jssrc/ui/server/routes/terminal.jssrc/ui/server/routes/npm.jssrc/ui/server/routes/workbench/taskRunner.jsscripts/release.js~/.git-commit-tool.json~/.zen-gitsync-instances.jsonproject files selected through GUI routesgit working tree files

Network endpoints2

registry.npmjs.org/zen-gitsync/latestregistry.npmjs.org/

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

src/ui/server/routes/exec.js exposes /api/exec-stream that spawns arbitrary user-supplied commands in project cwd.
src/ui/server/routes/workbench/taskRunner.js launches claude with --permission-mode bypassPermissions and --dangerously-skip-permissions from GUI tasks.
src/ui/server/routes/terminal.js can open a terminal and run supplied commands.
src/ui/server/routes/npm.js supports self-upgrade via npm install -g zen-gitsync and checks registry.npmjs.org.
scripts/release.js mutates package.json and publishes to npm, but only under explicit npm run release.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks.
index.js only exports config and startServer; it does not start the server or run commands on import.
src/gitCommit.js command execution is CLI/user-invoked and centered on git commit/pull/push workflow.
No source-inspected credential harvesting or covert exfiltration endpoint was found.
Network use is package-aligned: npm registry update checks and user-configured OpenAI-compatible LLM base URLs.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 99 file(s), 7.18 MB of source, external domains: 127.0.0.1, bugzilla.mozilla.org, code.google.com, developer.mozilla.org, developers.google.com, drafts.csswg.org, en.wikipedia.org, github.com, googlechrome.github.io, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, r12a.github.io, registry.npmjs.org, rolldown.rs, sass-lang.com, schema.org, stackoverflow.com, support.google.com, tools.ietf.org, wiki.whatwg.org, www.bing.com, www.dmoz.org, www.iana.org, www.ietf.org, www.npmjs.com, www.w3.org, www.whatwg.org

Oversized source lightweight scan

src/ui/public/assets/monaco-BFLoT2VD.js3.99 MB file, sampled 256 KB

HighEntropyStringsMinified

src/ui/public/assets/ts.worker-B0J26iPs.js6.58 MB file, sampled 256 KB

FilesystemNetworkChildProcess

src/ui/public/assets/vendor-DTvkqYXo.js9.13 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinified

Source & flagged code

9 flagged

scripts/run-tests.cjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * 跨平台 test runner: 递归枚举 test/ + src/**\/ 下的 *.test.{mjs,js,ts} 文件,

4 * 交给 node --test 运行。Windows + bash + zsh 都能跑通,避免 glob expansion 差异。

5 *

6 * 用法:

7 * node scripts/run-tests.cjs # 跑全部

8 * node scripts/run-tests.cjs --watch # watch 模式

9 * node scripts/run-tests.cjs <glob>... # 只跑匹配的文件(相对仓库根)

10 * node scripts/run-tests.cjs --list # 列出找到的测试文件,不执行

11 *

12 * 退出码:

13 * 0 = 全绿

14 * 1 = 有失败用例

15 * 2 = 找不到匹配文件 / 参数错误

16 */

17'use strict'

18const { readdirSync, statSync } = require('fs')

19const { join, relative, sep, resolve } = require('path')

20const { spawn } = require('child_process')

High

Child Process

Package source references child process execution.

scripts/run-tests.cjsView on unpkg · L19

22const ROOT = join(__dirname, '..')

23const SCAN_DIRS = [

24 join(ROOT, 'test'),

25 join(ROOT, 'src', 'utils'),

26 join(ROOT, 'src', 'ui', 'server'),

27]

28const PATTERNS = /\.(test|spec)\.(mjs|js|ts)$/

29const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'coverage'])

31function walk(dir, acc = []) {

32 let entries

33 try {

34 entries = readdirSync(dir)

35 } catch {

36 return acc

37 }

38 for (const name of entries) {

39 const p = join(dir, name)

src/ui/server/routes/exec.jsView file

Lines 4-44javascript

4// you may not use this file except in compliance with the License.

5// You may obtain a copy of the License at

6//

7// http://www.apache.org/licenses/LICENSE-2.0

8//

9// Unless required by applicable law or agreed to in writing, software

10// distributed under the License is distributed on an "AS IS" BASIS,

11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

12// See the License for the specific language governing permissions and

13// limitations under the License.

14//

src/ui/server/routes/npm.jsView file

Lines 1-26javascript

2//

3// Licensed under the Apache License, Version 2.0 (the "License");

4// you may not use this file except in compliance with the License.

5// You may obtain a copy of the License at

6//

7// http://www.apache.org/licenses/LICENSE-2.0

8//

9// Unless required by applicable law or agreed to in writing, software

10// distributed under the License is distributed on an "AS IS" BASIS,

11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

scripts/release.jsView file

Lines 1-45javascript

1#!/usr/bin/env node

3//

4// Licensed under the Apache License, Version 2.0 (the "License");

5// you may not use this file except in compliance with the License.

6// You may obtain a copy of the License at

7//

8// http://www.apache.org/licenses/LICENSE-2.0

9//

10// Unless required by applicable law or agreed to in writing, software

11// distributed under the License is distributed on an "AS IS" BASIS,

12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

src/ui/public/assets/html.worker-BO6WuOEO.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/ui/public/assets/html.worker-BO6WuOEO.jsView on unpkg · L29

src/ui/public/assets/vendor-DTvkqYXo.jsView file

•path = src/ui/public/assets/vendor-DTvkqYXo.js kind = oversized_source_file sizeBytes = 9570094 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/ui/public/assets/vendor-DTvkqYXo.jsView on unpkg

package.jsonView file

Lines 1-27json

2 "name": "zen-gitsync",

3 "version": "2.15.2",

4 "description": "Auto commit, scheduled sync, and visual GUI for Git. Run `g` in any repo for one-key commit & push, AI commit messages, scheduled background sync, and a drag-and-drop workflow builder.",

5 "main": "index.js",

6 "type": "module",

Source & flagged code

9 flagged · loading source

scripts/run-tests.cjsView file

19const { join, relative, sep, resolve } = require('path') L20: const { spawn } = require('child_process') L21:

High

Child Process

Package source references child process execution.

scripts/run-tests.cjsView on unpkg · L19

src/ui/server/routes/exec.jsView file

24// L25: // 之前走 spawn(command.trim(), [], { shell: true }) — `command` 直接来自 L26: // socket payload,任意 shell 都能跑(RCE 类)。改为 argv 模式:

High

Shell

Package source references shell execution.

src/ui/server/routes/exec.jsView on unpkg · L24

src/ui/server/routes/npm.jsView file

172const npmCmd = isWin ? 'npm.cmd' : 'npm' L173: const args = ['install', '-g', 'zen-gitsync', '--registry', 'https://registry.npmjs.org/'] L174: const cmd = isWin ? npmCmd : 'sudo' ... L181: try { L182: child = spawn(cmd, finalArgs, { L183: env: { ...process.env, FORCE_COLOR: '0' }, L184: windowsHide: true,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/ui/server/routes/npm.jsView on unpkg · L172

6// L7: // http://www.apache.org/licenses/LICENSE-2.0 L8: // ... L20: import os from 'os'; L21: import { exec, spawn } from 'child_process'; L22: import https from 'https'; ... L26: const __filename = fileURLToPath(import.meta.url); L27: const __dirname = path.dirname(__filename); L28: ... L64: L65: // 当前安装的版本（从外层 package.json 读取） L66: function getCurrentVersion() {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/ui/server/routes/npm.jsView on unpkg · L6

scripts/release.jsView file

7// L8: // http://www.apache.org/licenses/LICENSE-2.0 L9: // ... L27: * npm run release -- --skip-push # 只发布到 npm,不 push git L28: * npm run release -- --dry-run # 只打印计划,不真正改 package.json / commit / publish L29: */ ... L34: import { fileURLToPath } from 'node:url' L35: import { execSync, spawn } from 'node:child_process' L36: import chalk from 'chalk' ... L39: const __filename = fileURLToPath(import.meta.url) L40: const __dirname = path.dirname(__filename) L41: const rootDir = path.resolve(__dirname, '..')

Critical

Npm Publish Worm

Source mutates package metadata and republishes itself to npm.

scripts/release.jsView on unpkg · L7

25* npm run release # 全流程,自伤护栏全部开启 L26: * npm run release -- --sk[redacted] # 发布后不自动 npm install -g zen-gitsync L27: * npm run release -- --skip-push # 只发布到 npm,不 push git ... L34: import { fileURLToPath } from 'node:url' L35: import { execSync, spawn } from 'node:child_process' L36: import chalk from 'chalk'

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/release.jsView on unpkg · L25

src/ui/public/assets/html.worker-BO6WuOEO.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/ui/public/assets/html.worker-BO6WuOEO.jsView on unpkg · L29

src/ui/public/assets/vendor-DTvkqYXo.jsView file

•path = src/ui/public/assets/vendor-DTvkqYXo.js kind = oversized_source_file sizeBytes = 9570094 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/ui/public/assets/vendor-DTvkqYXo.jsView on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

Findings

3 Critical6 High3 Medium5 Low

CriticalNpm Publish Wormscripts/release.js

CriticalTrojan Source Unicodesrc/ui/public/assets/html.worker-BO6WuOEO.js

CriticalManifest Confusionpackage.json

HighChild Processscripts/run-tests.cjs

HighShellsrc/ui/server/routes/exec.js

HighSame File Env Network Executionsrc/ui/server/routes/npm.js

HighSandbox Evasion Gated Capabilitysrc/ui/server/routes/npm.js

HighRuntime Package Installscripts/release.js

HighOversized Source Filesrc/ui/public/assets/vendor-DTvkqYXo.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

scripts/run-tests.cjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * 跨平台 test runner: 递归枚举 test/ + src/**\/ 下的 *.test.{mjs,js,ts} 文件,

4 * 交给 node --test 运行。Windows + bash + zsh 都能跑通,避免 glob expansion 差异。

5 *

6 * 用法:

7 * node scripts/run-tests.cjs # 跑全部

8 * node scripts/run-tests.cjs --watch # watch 模式

9 * node scripts/run-tests.cjs <glob>... # 只跑匹配的文件(相对仓库根)

10 * node scripts/run-tests.cjs --list # 列出找到的测试文件,不执行

11 *

12 * 退出码:

13 * 0 = 全绿

14 * 1 = 有失败用例

15 * 2 = 找不到匹配文件 / 参数错误

16 */

17'use strict'

18const { readdirSync, statSync } = require('fs')

19const { join, relative, sep, resolve } = require('path')

20const { spawn } = require('child_process')

High

Child Process

Package source references child process execution.

scripts/run-tests.cjsView on unpkg · L19

22const ROOT = join(__dirname, '..')

23const SCAN_DIRS = [

24 join(ROOT, 'test'),

25 join(ROOT, 'src', 'utils'),

26 join(ROOT, 'src', 'ui', 'server'),

27]

28const PATTERNS = /\.(test|spec)\.(mjs|js|ts)$/

29const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'coverage'])

31function walk(dir, acc = []) {

32 let entries

33 try {

34 entries = readdirSync(dir)

35 } catch {

36 return acc

37 }

38 for (const name of entries) {

39 const p = join(dir, name)

src/ui/server/routes/exec.jsView file

Lines 4-44javascript

4// you may not use this file except in compliance with the License.

5// You may obtain a copy of the License at

6//

7// http://www.apache.org/licenses/LICENSE-2.0

8//

9// Unless required by applicable law or agreed to in writing, software

10// distributed under the License is distributed on an "AS IS" BASIS,

11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

12// See the License for the specific language governing permissions and

13// limitations under the License.

14//

src/ui/server/routes/npm.jsView file

Lines 1-26javascript

2//

3// Licensed under the Apache License, Version 2.0 (the "License");

4// you may not use this file except in compliance with the License.

5// You may obtain a copy of the License at

6//

7// http://www.apache.org/licenses/LICENSE-2.0

8//

9// Unless required by applicable law or agreed to in writing, software

10// distributed under the License is distributed on an "AS IS" BASIS,

11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

scripts/release.jsView file

Lines 1-45javascript

1#!/usr/bin/env node

3//

4// Licensed under the Apache License, Version 2.0 (the "License");

5// you may not use this file except in compliance with the License.

6// You may obtain a copy of the License at

7//

8// http://www.apache.org/licenses/LICENSE-2.0

9//

10// Unless required by applicable law or agreed to in writing, software

11// distributed under the License is distributed on an "AS IS" BASIS,

12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

src/ui/public/assets/html.worker-BO6WuOEO.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/ui/public/assets/html.worker-BO6WuOEO.jsView on unpkg · L29

src/ui/public/assets/vendor-DTvkqYXo.jsView file

•path = src/ui/public/assets/vendor-DTvkqYXo.js kind = oversized_source_file sizeBytes = 9570094 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/ui/public/assets/vendor-DTvkqYXo.jsView on unpkg

package.jsonView file

Lines 1-27json

2 "name": "zen-gitsync",

3 "version": "2.15.2",

5 "main": "index.js",

6 "type": "module",