registry / @goodandready/dsh-cron / 0.2.18
@goodandready/dsh-cron@0.2.18
⚠ Under reviewScheduled cron tasks, background automation and agent execution for DeepSeek Harness.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedlib/updater.jsView file
1import { spawn } from 'node:child_process';
L2: import { existsSync, readFileSync } from 'node:fs';
High
151packageSpec,
L152: `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
L153: ];
L154: const child = spawn(process.execPath, args, {
L155: cwd: target.profileDir,
...
L157: stdio: ['ignore', 'pipe', 'pipe'],
L158: env: { ...process.env, NO_COLOR: '1' },
L159: });
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/updater.jsView on unpkg · L151lib/api.jsView file
51try {
L52: const url = new URL(req.url, 'http://127.0.0.1');
L53: const parts = url.pathname.split('/').filter(Boolean);
...
L135: res.writeHead(304, { 'ETag': etag, 'Cache-Control': 'no-cache' });
L136: res.end();
L137: return;
Findings
5 High2 Medium5 Low
HighChild Processlib/updater.js
HighShell
HighSame File Env Network Executionlib/updater.js
HighSemantic Analysis Limitedcordis.patch.yml
HighPrevious Version Dangerous Deltalib/runner.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptolib/api.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @goodandready/dsh-cron@0.2.18.
See all versions of @goodandready/dsh-cron for other recorded verdicts.
- Review the evidence and your use of @goodandready/dsh-cron@0.2.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.