@goodandready/dsh-cron@0.3.31
Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.
AI Security Review
scanned 3d ago · by lpm-firewall-aiWith LLM actions enabled, generated task output can trigger an issue creation authenticated by the user’s Gitea token in a hard-coded publisher-named repository. The user enables a broad feature, but does not choose that target for the action, so this is a malicious account action.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A successful LLM task emits a `create_issue` directive while `llmActionsEnabled` is true.
Impact
Creates an account action in the publisher-selected `goodandready/dsh-cron` repository using the user's Gitea credentials, without the user choosing that target for the action.
Mechanism
The package reads `GITEA_TOKEN` or a token from `GITEA_CREDENTIALS_PATH`, then posts the directive’s issue content to a hard-coded repository through the local Gitea API.
Attack narrative
When enabled, a successful scheduled LLM run can emit a `create_issue` directive. The package reads the user's Gitea token from the environment or configured credentials file and submits the generated title and body to the fixed `goodandready/dsh-cron` repository on local Gitea. The generic LLM-actions toggle does not let the user select or confirm that publisher-chosen target for each action.
AI rationale
With LLM actions enabled, generated task output can trigger an issue creation authenticated by the user’s Gitea token in a hard-coded publisher-named repository. The user enables a broad feature, but does not choose that target for the action, so this is a malicious account action.
Evidence
lib/settings.jslib/scheduler/scheduler-completion.jslib/llm-actions.jsprocess.env.GITEA_CREDENTIALS_PATH (when configured; read)
Network endpoints1
127.0.0.1:3005/api/v1/repos/goodandready/dsh-cron/issues
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- After a successful LLM task, the scheduler parses output directives and executes them when `llmActionsEnabled` is true.
- A `create_issue` directive invokes issue creation using the directive’s title and body, or the task output.
- The issue helper defaults to the publisher-named repository `goodandready/dsh-cron` and reads a Gitea token from `GITEA_TOKEN` or `GITEA_CREDENTIALS_PATH`.
- It POSTs the issue using that token to the local Gitea API, without the caller choosing the repository.
Evidence against
- LLM action execution is disabled by default.
- The issue request goes to a local Gitea service at 127.0.0.1, rather than an unrelated external collector.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggedlib/tui-settings.jsView file
68label: 'Feishu Webhook URL',
L69: placeholder: 'https://open.feishu.cn/open-apis/bot/v2/hook/...',
L70: format: textFormat,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
lib/tui-settings.jsView on unpkg · L68lib/client.jsView file
128'form.sshTargetLabel': 'Fallback target (user@host, optional)',
L129: 'form.sshKeyLabel': 'Private key path (fallback, optional)',
L130: 'form.dockerImageLabel': 'Container image', 'form.sk[redacted]': 'Skill name',
...
L155: 'form.promptLabelLlm': 'Instruction / Prompt for the agent',
L156: 'form.promptPlaceholderScript': 'curl -fsSL https://... || exit 1',
L157: 'form.promptPlaceholderLlm': 'Describe exactly what the agent should do...',
...
L255: 'form.preflightLabel': 'Pre-flight check', 'form.preflightNone': 'None',
L256: 'form.preflightHttp': 'HTTP (2xx probe)', 'form.preflightShell': 'Shell command (exit code 0)',
L257: 'form.preflightDisk': 'Disk space (path:minPercent)',
...
L791: try {
L792: data = await res.json();
L793: } catch (jsonErr) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
Findings
3 Critical8 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationlib/tui-settings.js
CriticalCredential Exfiltrationlib/client.js
CriticalTrigger Reachable Dangerous Capabilitylib/client.js
HighTrigger Reachable Credential Exfiltrationlib/client.js
HighSemantic Analysis Limitedcordis.patch.yml
HighKnown Malware Source Similaritylib/runtimes/runner-external.js
HighKnown Malware Source Similaritylib/updater.js
HighKnown Malware Source Similaritylib/llm-actions.js
HighKnown Malware Source Similaritylib/scheduler/scheduler-preflight.js
HighKnown Malware Source Similaritylib/secrets.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @goodandready/dsh-cron@0.3.31.
See all versions of @goodandready/dsh-cron for other recorded verdicts.
- Avoid installing @goodandready/dsh-cron@0.3.31. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.