registry / @goodandready/dsh-cron / 0.2.5
@goodandready/dsh-cron@0.2.5
Scheduled cron tasks, background automation and agent execution for DeepSeek Harness.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a cron automation plugin with explicit task runtimes and notification channels, but it has no install-time execution, self-dependency, hidden payload, or unconfigured exfiltration path. The flagged command and network behavior is aligned with configured task automation.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user or host agent creates and activates a task.
Impact
Configured tasks may execute their supplied commands and send their results to configured services.
Mechanism
Configured task execution and notification delivery.
AI rationale
The package is a cron automation plugin with explicit task runtimes and notification channels, but it has no install-time execution, self-dependency, hidden payload, or unconfigured exfiltration path. The flagged command and network behavior is aligned with configured task automation.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No install lifecycle hook or self-dependency is declared.
- Command execution is a user-configured scheduled-task feature.
- The Cordis patch only registers this plugin.
Evidence against
- The package can run shell, Node, Python, SSH, Docker, and HTTP tasks.
- Configured notification channels can send task output to user-selected endpoints.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedlib/runner.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @goodandready/dsh-cron@0.2.3
matchedIdentity = npm:QGdvb2RhbmRyZWFkeS9kc2gtY3Jvbg:0.2.3
similarity = 0.538
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/runner.jsView on unpkg72async createTaskWorktree(cwd, task) {
L73: const { execFile } = await import('node:child_process');
L74: const path = await import('node:path');
High
92await new Promise((resolve) => {
L93: execFile('git', ['-C', cwd, 'worktree', 'remove', wtPath], { maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
L94: if (err) {
...
L103: async _runHttp(task, request, signal) {
L104: const res = await fetch(request.url, {
L105: method: request.method,
L106: headers: request.headers,
L107: body: request.body,
L108: signal,
High
Command Output Exfiltration
Findings
1 Critical4 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltalib/runner.js
HighChild Processlib/runner.js
HighCommand Output Exfiltrationlib/runner.js
HighTrigger Reachable Command Output Exfiltrationlib/runner.js
HighSemantic Analysis Limitedcordis.patch.yml
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @goodandready/dsh-cron@0.2.5.
See all versions of @goodandready/dsh-cron for other recorded verdicts.
- Review the evidence and your use of @goodandready/dsh-cron@0.2.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.