registry / @goodandready/dsh-cron / 0.2.8
@goodandready/dsh-cron@0.2.8
Scheduled cron tasks, background automation and agent execution for DeepSeek Harness.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedlib/runner.jsView file
72async createTaskWorktree(cwd, task) {
L73: const { execFile } = await import('node:child_process');
L74: const path = await import('node:path');
High
92await new Promise((resolve) => {
L93: execFile('git', ['-C', cwd, 'worktree', 'remove', wtPath], { maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
L94: if (err) {
...
L103: async _runHttp(task, request, signal) {
L104: const res = await fetch(request.url, {
L105: method: request.method,
L106: headers: request.headers,
L107: body: request.body,
L108: signal,
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
lib/runner.jsView on unpkg · L9292Trigger-reachable command-output exfiltration chain: manifest.main -> lib/index.js -> lib/runner.js
L92: await new Promise((resolve) => {
L93: execFile('git', ['-C', cwd, 'worktree', 'remove', wtPath], { maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
L94: if (err) {
...
L103: async _runHttp(task, request, signal) {
L104: const res = await fetch(request.url, {
L105: method: request.method,
L106: headers: request.headers,
L107: body: request.body,
L108: signal,
Findings
4 High2 Medium4 Low
HighChild Processlib/runner.js
HighCommand Output Exfiltrationlib/runner.js
HighTrigger Reachable Command Output Exfiltrationlib/runner.js
HighSemantic Analysis Limitedcordis.patch.yml
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @goodandready/dsh-cron@0.2.8.
See all versions of @goodandready/dsh-cron for other recorded verdicts.
- Review the evidence and your use of @goodandready/dsh-cron@0.2.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.