@goodandready/dsh-cron@0.3.29
Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe issue-creation path uses a locally available Gitea credential to act on a hard-coded publisher repository when enabled LLM actions produce a directive. Because the user cannot choose or confirm that target, this is an unrequested account action; the opt-in gate and local endpoint reduce exposure but do not resolve the target mismatch.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A task run produces a `create_issue` directive while LLM actions are enabled and a Gitea token is available.
Impact
The token may be used to create an issue in `goodandready/dsh-cron` without the user selecting or confirming that target.
Mechanism
The package reads `GITEA_TOKEN` or a token from the configured credentials file and POSTs the issue to the hard-coded repository through local Gitea.
Attack narrative
When LLM actions are enabled, a task-generated `create_issue` directive can cause the package to read a local Gitea token and create an issue in the hard-coded `goodandready/dsh-cron` repository. The action target is not selected or confirmed by the user. The feature is off by default and the request goes to local Gitea, which limits the risk but does not change the publisher-selected account target.
AI rationale
The issue-creation path uses a locally available Gitea credential to act on a hard-coded publisher repository when enabled LLM actions produce a directive. Because the user cannot choose or confirm that target, this is an unrequested account action; the opt-in gate and local endpoint reduce exposure but do not resolve the target mismatch.
Evidence
lib/llm-actions.jslib/settings.jsGITEA_CREDENTIALS_PATH (configured path; read only when the action runs)
Network endpoints1
127.0.0.1:3005
Decision evidence
public snapshotAI called this Malicious at 89.0% confidence as Malware with low false-positive risk.
Evidence for block
- When LLM actions are enabled, a `create_issue` directive can post an issue using the task output or directive body.
- The issue helper reads `GITEA_TOKEN` or a token from a configured credentials file, then posts to the hard-coded `goodandready/dsh-cron` repository.
- The feature defaults to disabled, but enabling it does not let the user choose or confirm the issue target.
Evidence against
- The issue action requires LLM actions to be enabled; that setting defaults to false.
- The request goes to a local Gitea service at `127.0.0.1:3005`, not to an external host.
- The SSH-key routing hint resolves to a UI field for an optional private-key path; the inspected client source shows no key transmission.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggedlib/tui-settings.jsView file
68label: 'Feishu Webhook URL',
L69: placeholder: 'https://open.feishu.cn/open-apis/bot/v2/hook/...',
L70: format: textFormat,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
lib/tui-settings.jsView on unpkg · L68lib/client.jsView file
128'form.sshTargetLabel': 'Fallback target (user@host, optional)',
L129: 'form.sshKeyLabel': 'Private key path (fallback, optional)',
L130: 'form.dockerImageLabel': 'Container image', 'form.sk[redacted]': 'Skill name',
...
L155: 'form.promptLabelLlm': 'Instruction / Prompt for the agent',
L156: 'form.promptPlaceholderScript': 'curl -fsSL https://... || exit 1',
L157: 'form.promptPlaceholderLlm': 'Describe exactly what the agent should do...',
...
L255: 'form.preflightLabel': 'Pre-flight check', 'form.preflightNone': 'None',
L256: 'form.preflightHttp': 'HTTP (2xx probe)', 'form.preflightShell': 'Shell command (exit code 0)',
L257: 'form.preflightDisk': 'Disk space (path:minPercent)',
...
L791: try {
L792: data = await res.json();
L793: } catch (jsonErr) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
Findings
3 Critical8 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationlib/tui-settings.js
CriticalCredential Exfiltrationlib/client.js
CriticalTrigger Reachable Dangerous Capabilitylib/client.js
HighTrigger Reachable Credential Exfiltrationlib/client.js
HighSemantic Analysis Limitedcordis.patch.yml
HighKnown Malware Source Similaritylib/runtimes/runner-external.js
HighKnown Malware Source Similaritylib/updater.js
HighKnown Malware Source Similaritylib/llm-actions.js
HighKnown Malware Source Similaritylib/scheduler/scheduler-preflight.js
HighKnown Malware Source Similaritylib/secrets.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @goodandready/dsh-cron@0.3.29.
See all versions of @goodandready/dsh-cron for other recorded verdicts.
- Avoid installing @goodandready/dsh-cron@0.3.29. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.