is a tool to identify misconfigurations and security anti-patterns in Electron
Software developers and security auditors can use this tool to detect and mitigate potential weaknesses and implementation bugs when developing applications using Electron. A good understanding of Electron
(in)security is still required when using Electronegativity, as some of the potential issues detected by the tool require manual investigation.
Major releases are pushed to NPM and can be simply installed using:
$ npm install @doyensec/electronegativity -g
$ electronegativity -h
||output the version number
||input (directory, .js, .htm, .asar)
||save the results to a file in csv or sarif format
||output usage information
Using electronegativity to look for issues in a directory containing an Electron app:
$ electronegativity -i /path/to/electron/app
Using electronegativity to look for issues in an
asar archive and saving the results in a csv file:
$ electronegativity -i /path/to/asar/archive -o result.csv
node --max-old-space-size=4096 electronegativity -i /path/to/asar/archive -o result.csv
Electronegativity was made possible thanks to the work of Claudio Merloni, Ibram Marzouk, Jaroslav Lobačevski and many other contributors.
This work has been sponsored by Doyensec LLC.