registry / @goodandready/dsh-cron / 0.3.34
@goodandready/dsh-cron@0.3.34
Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe scanner’s SSH and Feishu indicators correspond to a user-entered SSH key path and a configurable notification webhook, not automatic key collection or exfiltration. The Gitea issue action is gated behind an LLM-actions setting that defaults to false and sends its credential to a local API endpoint.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Plugin use; LLM actions require an explicit setting enabled by the user.
Impact
No unintended credential disclosure or publisher-directed account action was established from the reviewed source.
Mechanism
Task configuration and execution support scheduled automation, notifications, and optional structured LLM directives. The reviewed credential use is limited to the local Gitea API.
AI rationale
The scanner’s SSH and Feishu indicators correspond to a user-entered SSH key path and a configurable notification webhook, not automatic key collection or exfiltration. The Gitea issue action is gated behind an LLM-actions setting that defaults to false and sends its credential to a local API endpoint.
Evidence
lib/scheduler/scheduler-completion.jslib/settings.jslib/llm-actions.jslib/client.jslib/tui-settings.jspackage.json
Network endpoints2
127.0.0.1:3005/api/v1/repos/${repo}/issuesopen.feishu.cn/open-apis/bot/v2/hook/...
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest has no install, preinstall or postinstall lifecycle script.
- LLM action directives run only after a successful LLM task and when the setting is enabled; that setting defaults to false.
- The issue-creation helper uses a Gitea token only for its local API endpoint at 127.0.0.1:3005.
- The SSH key path is a user-entered task field, and Feishu appears as a configurable notification webhook.
Evidence against
- When enabled, an LLM action can create an issue in the default repository goodandready/dsh-cron using a Gitea credential; this is a sensitive capability, but it is gated by the LLM-actions setting.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggedlib/tui-settings.jsView file
68label: 'Feishu Webhook URL',
L69: placeholder: 'https://open.feishu.cn/open-apis/bot/v2/hook/...',
L70: format: textFormat,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
lib/tui-settings.jsView on unpkg · L68lib/client.jsView file
128'form.sshTargetLabel': 'Fallback target (user@host, optional)',
L129: 'form.sshKeyLabel': 'Private key path (fallback, optional)',
L130: 'form.dockerImageLabel': 'Container image', 'form.sk[redacted]': 'Skill name',
...
L155: 'form.promptLabelLlm': 'Instruction / Prompt for the agent',
L156: 'form.promptPlaceholderScript': 'curl -fsSL https://... || exit 1',
L157: 'form.promptPlaceholderLlm': 'Describe exactly what the agent should do...',
...
L255: 'form.preflightLabel': 'Pre-flight check', 'form.preflightNone': 'None',
L256: 'form.preflightHttp': 'HTTP (2xx probe)', 'form.preflightShell': 'Shell command (exit code 0)',
L257: 'form.preflightDisk': 'Disk space (path:minPercent)',
...
L829: try {
L830: data = await res.json();
L831: } catch (jsonErr) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
Findings
3 Critical8 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationlib/tui-settings.js
CriticalCredential Exfiltrationlib/client.js
CriticalTrigger Reachable Dangerous Capabilitylib/client.js
HighTrigger Reachable Credential Exfiltrationlib/client.js
HighSemantic Analysis Limitedcordis.patch.yml
HighKnown Malware Source Similaritylib/runtimes/runner-external.js
HighKnown Malware Source Similaritylib/updater.js
HighKnown Malware Source Similaritylib/llm-actions.js
HighKnown Malware Source Similaritylib/scheduler/scheduler-preflight.js
HighKnown Malware Source Similaritylib/secrets.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @goodandready/dsh-cron@0.3.34.
See all versions of @goodandready/dsh-cron for other recorded verdicts.
- Review the evidence and your use of @goodandready/dsh-cron@0.3.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.