registry / @goodandready/dsh-cron / 0.2.50
@goodandready/dsh-cron@0.2.50
Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest and patch describe a DSH scheduler plugin without an install lifecycle hook. The cited credential-related client code sends settings to a relative package route, while the flagged runtime regions handle UI lifecycle; the scanner hints do not establish an attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The host loads the registered DSH plugin; a user saves settings or edits task configuration.
Impact
No confirmed credential disclosure or other attack impact was identified.
Mechanism
The client submits settings to a relative package route and exposes HTTP headers as an editable task field. No unrelated credential recipient or attack behavior was established.
AI rationale
The manifest and patch describe a DSH scheduler plugin without an install lifecycle hook. The cited credential-related client code sends settings to a relative package route, while the flagged runtime regions handle UI lifecycle; the scanner hints do not establish an attack.
Evidence
package.jsoncordis.patch.ymllib/client.js
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a DSH automation runner and points to lib/index.js as its entrypoint.
- The manifest scripts show test, build, pretest, and preflight commands, with no install lifecycle hook.
- The patch registers this package as a DSH plugin with empty configuration.
- The client submits the bot token to the package’s same-origin settings route when saving settings.
- The client presents HTTP Authorization headers as an editable task form field.
- The cited client regions manage and clean up UI observers and event listeners.
Evidence against
- The inspected credential-related client behavior is a settings save to a relative package route; the Authorization header appears in an editable task form.
- The cited runtime-operation regions concern UI mounting and cleanup, not credential transfer or account actions.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flaggedlib/client.jsView file
177'form.sshTargetLabel': 'Fallback target (user@host, optional)',
L178: 'form.sshKeyLabel': 'Private key path (fallback, optional)',
L179: 'form.dockerImageLabel': 'Container image',
...
L210: 'form.promptLabelLlm': 'Instruction / Prompt for the agent',
L211: 'form.promptPlaceholderScript': 'curl -fsSL https://... || exit 1',
L212: 'form.promptPlaceholderLlm': 'Describe exactly what the agent should do...',
...
L342: 'form.preflightHttp': 'HTTP (2xx probe)',
L343: 'form.preflightShell': 'Shell command (exit code 0)',
L344: 'form.preflightDisk': 'Disk space (path:minPercent)',
...
L1145: try {
L1146: data = await res.json();
L1147: } catch (jsonErr) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
lib/client.jsView on unpkg · L177177Trigger-reachable chain: manifest.exports -> lib/client.js
L177: 'form.sshTargetLabel': 'Fallback target (user@host, optional)',
L178: 'form.sshKeyLabel': 'Private key path (fallback, optional)',
L179: 'form.dockerImageLabel': 'Container image',
...
L210: 'form.promptLabelLlm': 'Instruction / Prompt for the agent',
L211: 'form.promptPlaceholderScript': 'curl -fsSL https://... || exit 1',
L212: 'form.promptPlaceholderLlm': 'Describe exactly what the agent should do...',
...
L342: 'form.preflightHttp': 'HTTP (2xx probe)',
L343: 'form.preflightShell': 'Shell command (exit code 0)',
L344: 'form.preflightDisk': 'Disk space (path:minPercent)',
...
L1145: try {
L1146: data = await res.json();
L1147: } catch (jsonErr) {
Critical
Trigger Reachable Dangerous Capability
Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationlib/client.js
CriticalTrigger Reachable Dangerous Capabilitylib/client.js
HighTrigger Reachable Credential Exfiltrationlib/client.js
HighSemantic Analysis Limitedcordis.patch.yml
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @goodandready/dsh-cron@0.2.50.
See all versions of @goodandready/dsh-cron for other recorded verdicts.
- Review the evidence and your use of @goodandready/dsh-cron@0.2.50 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.