registry / @goodandready/dsh-cron / 0.2.26
@goodandready/dsh-cron@0.2.26
⚠ Under reviewScheduled cron tasks, background automation and agent execution for DeepSeek Harness.
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedlib/updater.jsView file
1import { spawn } from 'node:child_process';
L2: import { existsSync, readFileSync } from 'node:fs';
High
151packageSpec,
L152: `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
L153: ];
L154: const child = spawn(process.execPath, args, {
L155: cwd: target.profileDir,
...
L157: stdio: ['ignore', 'pipe', 'pipe'],
L158: env: { ...process.env, NO_COLOR: '1' },
L159: });
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/updater.jsView on unpkg · L151lib/api.jsView file
66try {
L67: const url = new URL(req.url, 'http://127.0.0.1');
L68: const parts = url.pathname.split('/').filter(Boolean);
...
L150: res.writeHead(304, { 'ETag': etag, 'Cache-Control': 'no-cache' });
L151: res.end();
L152: return;
Findings
4 High2 Medium5 Low
HighChild Processlib/updater.js
HighShell
HighSame File Env Network Executionlib/updater.js
HighSemantic Analysis Limitedcordis.patch.yml
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptolib/api.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @goodandready/dsh-cron@0.2.26.
See all versions of @goodandready/dsh-cron for other recorded verdicts.
- Review the evidence and your use of @goodandready/dsh-cron@0.2.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.