@feiyang666/dsh-mobile-remote@1.4.6: Suspicious npm security | LPM Firewall

Loading npm security reports…

@feiyang666/dsh-mobile-remote@1.4.6: Suspicious npm security | LPM Firewall

Source & flagged code

6 flagged · loading source

lib/index.jsView file

34} from 'node:fs' L35: import { spawn } from 'node:child_process' L36: import qrcode from './qrcode.js'

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L34

lib/external.jsView file

23} from 'node:fs' L24: import { spawn } from 'node:child_process' L25: ... L27: * 可用 DSH_REMOTE_SERVER 覆盖。 */ L28: const DEFAULT_SERVER_BASE = 'https://api.deepseekharness.desktop.cwj666.top' L29: ... L33: (body && typeof body.serverBase === 'string' && body.serverBase.trim()) L34: || process.env.DSH_REMOTE_SERVER L35: || DEFAULT_SERVER_BASE ... L40: function externalDir() { L41: const home = process.env.DSH_HOME || join(homedir(), '.dsh') L42: return join(home, 'plugins', 'dsh-mobile-remote', 'external')

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

lib/external.jsView on unpkg · L23

23Trigger-reachable chain: manifest.main -> lib/index.js -> lib/external.js L23: } from 'node:fs' L24: import { spawn } from 'node:child_process' L25: ... L27: * 可用 DSH_REMOTE_SERVER 覆盖。 */ L28: const DEFAULT_SERVER_BASE = 'https://api.deepseekharness.desktop.cwj666.top' L29: ... L33: (body && typeof body.serverBase === 'string' && body.serverBase.trim()) L34: || process.env.DSH_REMOTE_SERVER L35: || DEFAULT_SERVER_BASE ... L40: function externalDir() { L41: const home = process.env.DSH_HOME || join(homedir(), '.dsh') L42: return join(home, 'plugins', 'dsh-mobile-remote', 'external')

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/external.jsView on unpkg · L23

•matchType = previous_version_dangerous_delta matchedPackage = @feiyang666/dsh-mobile-remote@1.4.5 matchedIdentity = npm:[redacted]:1.4.5 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/external.jsView on unpkg

23} from 'node:fs' L24: import { spawn } from 'node:child_process' L25: ... L27: * 可用 DSH_REMOTE_SERVER 覆盖。 */ L28: const DEFAULT_SERVER_BASE = 'https://api.deepseekharness.desktop.cwj666.top' L29: ... L33: (body && typeof body.serverBase === 'string' && body.serverBase.trim()) L34: || process.env.DSH_REMOTE_SERVER L35: || DEFAULT_SERVER_BASE

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/external.jsView on unpkg · L23

23Trigger-reachable credential exfiltration chain: manifest.main -> lib/index.js -> lib/external.js L23: } from 'node:fs' L24: import { spawn } from 'node:child_process' L25: ... L27: * 可用 DSH_REMOTE_SERVER 覆盖。 */ L28: const DEFAULT_SERVER_BASE = 'https://api.deepseekharness.desktop.cwj666.top' L29: ... L33: (body && typeof body.serverBase === 'string' && body.serverBase.trim()) L34: || process.env.DSH_REMOTE_SERVER L35: || DEFAULT_SERVER_BASE ... L40: function externalDir() { L41: const home = process.env.DSH_HOME || join(homedir(), '.dsh') L42: return join(home, 'plugins', 'dsh-mobile-remote', 'external')

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

lib/external.jsView on unpkg · L23

Source & flagged code

6 flagged

lib/index.jsView file

Lines 14-54javascript

14//

15// 为什么命令行启动也能远程控制（不需要桌面端）：

16// 官方 CLI 出于安全拒绝 `--host 0.0.0.0`（见 dsh-web-app/startup.ts），但

17// 官方 `--patch <overlay>` / profile 的 cordis.patch.yml 配置层完整支持

18// `webserver.host: 0.0.0.0`，且 profile patch 由 app-boot 的 watchUserPatches

19// 通过 Cordis HMR 热重载。因此本插件在设置页切换开关 = 写入 / 移除 profile

20// patch 的 webserver 行，即可让 dsh 重新监听所有网卡——与桌面端 `--patch`

21// overlay 机制一致，官方 CLI 用户无需安装桌面端。

22//

23// 零运行时依赖（除 lib/qrcode.js 内联的 MIT QR 生成器）：

24// 不 import 任何 dsh-client / dsh-host 内部包，仅使用 Node 内置模块与

25// webServer 服务公开的 tapIndex / register 接口。

26

27import {

28 networkInterfaces, homedir, hostname, cpus, totalmem, freemem,

29 platform, release, arch, loadavg, uptime as osUptime,

30} from 'node:os'

31import { join, dirname } from 'node:path'

32import {

33 existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, rmSync,

34} from 'node:fs'

35import { spawn } from 'node:child_process'

36import qrcode from './qrcode.js'

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L34

37import {

38 startExternal, stopExternal, externalView,

39 autoRestoreExternal, loadPersistedState, DEFAULT_SERVER_BASE,

40 frpcLogTail,

41} from './external.js'

42import {

43 hasPassword, verifyPassword, setPassword,

44 isEnabled, login, verifyToken, revokeToken, clearSessions,

45} from './password.js'

46

47/** 插件名（loader 诊断用）。 */

48export const name = 'dsh-mobile-remote'

49

50/** 依赖 dsh-host-webserver 注入的 webServer 服务，保证 tapIndex / register 可用。 */

51export const inject = ['webServer']

52

53/** 移动端断点：与 DSH 原生 SIDEBAR_AUTO_COLLAPSE = 1024 对齐。 */

54const MOBILE_MAX_WIDTH = 1024

lib/external.jsView file

Lines 3-43javascript

3// 负责把"外网访问"做成一个开关：

4// - 从中转服务（dsh-update-server）通过绑定码换取 frpc 配置 + 外网链接

5// - 下载/定位 frpc 可执行文件，写入 frpc.toml 并启动子进程

6// - 写 profile 的 connection trustedHosts，放行外网域名（通过 /api 信任围栏）

7// - 心跳上报、状态查询、停止

8//

9// 零运行时依赖：仅 Node 内置模块。frpc 二进制由中转服务提供或用户本地放置。

10//

11// 稳健性说明（针对"开启难/开了又关"问题）：

12// - 强制给 frpc.toml 追加 loginFailExit=false：连不上 frps 时持续重试，

13// 而不是立即自杀退出导致开关被前端刷回"关闭"。