registry / AI-agent control-surface risk / @marecgents/dsh-hub

@marecgents/dsh-hub

DeepSeek Harness desktop hub — Tauri 2.x shell + dsh web plugin layer. This npm package ships the plugin half (client UI + HTTP routes + cordis.patch.yml); the desktop shell ships as the NSIS installer (see build/).

This report shows the evidence for @marecgents/dsh-hub@0.1.4. 2 of 18 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic lifecycle hook performs unconsented global installation of a separate AI-agent CLI and package manager, plus host cleanup. This is concrete install-time control-surface mutation, not a package-local build step.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install, which runs postinstall automatically.

Impact

A dependency installation can alter the user's global agent and package-management toolchain without an explicit command.

Mechanism

Lifecycle-driven global package installation and host file deletion.

Policy narrative

The package declares an automatic postinstall hook. On installation, it probes several registries and, if its prerequisite check fails, runs a global installation of @deepseek-ai/dsh; it separately installs pnpm globally when missing. The hook also removes selected files in the global npm prefix and may delete a desktop shortcut. This mutates a broad external AI-agent and package-management control surface without requiring the user to invoke a setup command.

AI rationale

Evidence

package.jsonscripts/postinstall.mjs

Network endpoints4

registry.npmjs.org/registry.npmmirror.commirrors.huaweicloud.com/repository/npm/mirrors.cloud.tencent.com/npm/

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.

Evidence for policy risk

The package automatically runs a postinstall script.
The postinstall script probes registries and globally installs the separate @deepseek-ai/dsh agent CLI when missing or broken.
The same automatic hook globally installs pnpm when absent.
The hook also removes files from the global npm prefix and a desktop shortcut during installation.

Evidence against

No credential collection or secret exfiltration was found in the inspected lifecycle code.
The terminal API requires a per-process token and loopback host checks.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 101 file(s), 1.75 MB of source, external domains: 127.0.0.1, bellard.org, developer.mozilla.org, github.com, mirrors.cloud.tencent.com, mirrors.huaweicloud.com, nodejs.org, registry.npmjs.org, registry.npmmirror.com, rustup.rs, winlibs.com, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 },

21 "./cordis.patch.yml": "./cordis.patch.yml",

22 "./src/*": "./src/*",

23 "./package.json": "./package.json"

24 },

25 "files": [

26 "lib",

27 "src",

28 "bin",

29 "scripts",

30 "assets",

31 "cordis.patch.yml",

32 "README.md"

33 ],

34 "bin": {},

35 "scripts": {

36 "build": "tsc && tsc -p tsconfig.client.json",

37 "build:client": "node ./scripts/build-client.mjs",

38 "build:installer": "node ./scripts/build-installer.mjs",

39 "prepack": "npm run build && npm run build:client",

40 "postinstall": "node ./scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "postuninstall": "node ./scripts/postuninstall.mjs",

42 "tauri:dev": "tauri dev",

43 "tauri:build": "tauri build",

44 "tauri:icon": "tauri icon",

45 "m1:check": "node scripts/check-tauri-conf.mjs",

46 "m1:ipc-smoke": "node scripts/ipc-smoke.mjs",

47 "prepare": "node scripts/git-hooks.mjs install"

48 },

49 "dsh": {

50 "bundle": {

51 "patch": "./cordis.patch.yml"

52 },

53 "client": {

54 "platform": "web",

55 "inject": [

56 "@deepseek-ai/dsh-client-runtime",

57 "@deepseek-ai/dsh-client-locale",

58 "@deepseek-ai/dsh-client-ui-settings"

59 ]

60 }

bin/dsh-web-sidecar.mjsView file

Lines 7-71javascript

7 * ② 调用 scripts/assemble-profile.mjs（spawn node，传 DSH_HOME +

8 * DSH_HUB_PACKAGE_ROOT=<repo 根>）确保 web profile 装配（scoped bundle +

9 * junction 自愈，幂等）；

10 * ③ 探测/解析 node 路径：优先 DSH_HUB_NODE env → PATH 里 node →

scripts/build-installer.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * build-installer.mjs — dsh-hub 桌面壳一键打包（NSIS 安装器）。

4 *

5 * 职责（模块类别：Helper — 打包脚本）：

6 * 1. 动态检测工具链（Node / npm / cargo / rustup / MSVC vcvars64.bat / GNU gcc），

7 * 只报告、不硬编码任何路径（clone 任何人机器都能跑，工具位置因人而异）；

8 * 2. 前置检查与构建：node_modules 缺失时自动 npm install（提示可能慢），

9 * 然后依次执行 npm run build（host tsc → lib/）与 npm run build:client（client bundle）；

10 * 3. 打包：MSVC 模式在 vcvars64.bat 环境内执行 npm run tauri:build（= cargo tauri build，

scripts/build-client.mjsView file

Lines 76-107javascript

76 mkdirSync(targetScope, { recursive: true })

77 let linked = 0

78 for (const name of SDK_PACKAGES) {

79 const

scripts/dsh-deps-install.ps1View file

•path = scripts/dsh-deps-install.ps1 kind = build_helper sizeBytes = 15919 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/dsh-deps-install.ps1View on unpkg

cordis.patch.ymlView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cordis.patch.ymlView on unpkg

lib/services/pty-manager.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @marecgents/dsh-hub@0.1.3 matchedIdentity = npm:QG1hcmVjZ2VudHMvZHNoLWh1Yg:0.1.3 similarity = 0.686 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/services/pty-manager.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/dsh-web-sidecar.mjsView file

27L28: import { spawnSync } from 'node:child_process' L29: import { existsSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/dsh-web-sidecar.mjsView on unpkg · L27

Findings

1 Critical6 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltalib/services/pty-manager.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/dsh-web-sidecar.mjs

HighShellbin/dsh-web-sidecar.mjs

HighCross File Remote Execution Contextscripts/build-installer.mjs

HighRuntime Package Installscripts/build-client.mjs

HighSemantic Analysis Limitedcordis.patch.yml

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/dsh-deps-install.ps1

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @marecgents/dsh-hub@0.1.4.

The versions list below shows the verdict for each recorded version.

Avoid installing @marecgents/dsh-hub@0.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-01 14:34:23.574Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

18 known versions

0.1.4latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 1, 2026, 2:27 PM 0.1.3SuspiciousInstall Hook AbuseWarnPublishedAug 31, 2026, 4:25 PM 0.1.2SuspiciousInstall Hook AbuseWarnPublishedAug 31, 2026, 3:57 PM 0.1.1SuspiciousInstall Hook AbuseWarnPublishedAug 31, 2026, 11:41 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code