@marecgents/dsh-hub@0.0.1-rc.13: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@marecgents/dsh-hub@0.0.1-rc.13: Suspicious npm security report | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/dsh-hub.mjsView file

11L12: import { spawn, spawnSync } from 'node:child_process' L13: import { existsSync, appendFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/dsh-hub.mjsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @marecgents/dsh-hub@0.0.1-rc.12 matchedPath = bin/dsh-hub.mjs matchedIdentity = npm:QG1hcmVjZ2VudHMvZHNoLWh1Yg:0.0.1-rc.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/dsh-hub.mjsView on unpkg

bin/multi-instance.mjsView file

73try { L74: const ps = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', L75: "Get-CimInstance Win32_Process -Filter \"Name='node.exe' -or Name='dsh-hub.exe' -or Name='dsh-hub-guard.exe'\" | Where-Object { $_.CommandLine -match 'dsh.*web' } | Select-Object -...

High

Shell

Package source references shell execution.

bin/multi-instance.mjsView on unpkg · L73

bin/launcher.mjsView file

276log('dsh CLI missing; attempting global install…') L277: const install = spawnSync(process.env.ComSpec, ['/d', '/s', '/c', 'npm install -g @deepseek-ai/dsh'], { L278: encoding: 'utf8', timeout: 180000, windowsHide: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/launcher.mjsView on unpkg · L276

•matchType = normalized_sha256 matchedPackage = @marecgents/dsh-hub@0.0.1-rc.12 matchedPath = bin/launcher.mjs matchedIdentity = npm:QG1hcmVjZ2VudHMvZHNoLWh1Yg:0.0.1-rc.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/launcher.mjsView on unpkg

bin/hub-exe.mjsView file

•matchType = normalized_sha256 matchedPackage = @marecgents/dsh-hub@0.0.1-rc.12 matchedPath = bin/hub-exe.mjs matchedIdentity = npm:QG1hcmVjZ2VudHMvZHNoLWh1Yg:0.0.1-rc.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/hub-exe.mjsView on unpkg

lib/services/explorer.jsView file

•matchType = normalized_sha256 matchedPackage = @marecgents/dsh-hub@0.0.1-rc.12 matchedPath = lib/services/explorer.js matchedIdentity = npm:QG1hcmVjZ2VudHMvZHNoLWh1Yg:0.0.1-rc.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/services/explorer.jsView on unpkg

src/services/explorer.tsView file

•matchType = normalized_sha256 matchedPackage = @marecgents/dsh-hub@0.0.1-rc.12 matchedPath = src/services/explorer.ts matchedIdentity = npm:QG1hcmVjZ2VudHMvZHNoLWh1Yg:0.0.1-rc.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/services/explorer.tsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 22-62json

22 "./src/*": "./src/*",

23 "./package.json": "./package.json"

24 },

25 "files": [

26 "lib",

27 "src",

28 "bin",

29 "scripts",

30 "assets",

31 "cordis.patch.yml",

32 "README.md"

33 ],

34 "bin": {

35 "dsh-hub": "bin/dsh-hub.mjs"

36 },

37 "scripts": {

38 "build": "tsc",

39 "build:client": "node ./scripts/build-client.mjs",

40 "generate:icons": "node ./scripts/generate-icon.mjs",

41 "prepack": "npm run build && npm run build:client",

42 "postinstall": "node ./scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 "postuninstall": "node ./scripts/postuninstall.mjs"

44 },

45 "dsh": {

46 "bundle": {

47 "patch": "./cordis.patch.yml"

48 },

49 "client": {

50 "platform": "web",

51 "inject": [

52 "@deepseek-ai/dsh-client-runtime",

53 "@deepseek-ai/dsh-client-locale",

54 "@deepseek-ai/dsh-client-ui-settings"

55 ]

56 }

57 },

58 "engines": {

59 "node": ">=24.0.0"

60 },

61 "dependencies": {

62 "@deepseek-ai/schemastery": "^3.18.1",

bin/dsh-hub.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * dsh-hub — the dsh-hub launcher command. Boots `dsh web` with the

4 * desktop-shell marker set, so the plugin opens the native window and injects

5 * the plugin config page. Anything after `dsh-hub` is forwarded to `dsh web`.

6 *

7 * Usage:

8 * dsh-hub # boot dsh web with the desktop shell

9 * dsh-hub --port 4000 # forward extra args to dsh web

10 */

11

bin/multi-instance.mjsView file

Lines 53-93javascript

53 try {

54 const result = spawnSync('netstat', ['-ano', '-p', 'tcp'], { encoding: 'utf8', windowsHide: true })

55

bin/launcher.mjsView file

Lines 256-296javascript

256 process.exit(0)

257 }

258

259 // Clear any stale quit marker from a previous run; this launcher is now the

260 // single owner and must not mistake an old marker for a new intentional quit.

261 clearQuitMarker()

262

263 // Concurrent-instance guard (shared with the `dsh-hub` terminal command):

bin/hub-exe.mjsView file

•matchType = normalized_sha256 matchedPackage = @marecgents/dsh-hub@0.0.1-rc.12 matchedPath = bin/hub-exe.mjs matchedIdentity = npm:QG1hcmVjZ2VudHMvZHNoLWh1Yg:0.0.1-rc.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/hub-exe.mjsView on unpkg

lib/services/explorer.jsView file

•matchType = normalized_sha256 matchedPackage = @marecgents/dsh-hub@0.0.1-rc.12 matchedPath = lib/services/explorer.js matchedIdentity = npm:QG1hcmVjZ2VudHMvZHNoLWh1Yg:0.0.1-rc.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/services/explorer.jsView on unpkg

src/services/explorer.tsView file

•matchType = normalized_sha256 matchedPackage = @marecgents/dsh-hub@0.0.1-rc.12 matchedPath = src/services/explorer.ts matchedIdentity = npm:QG1hcmVjZ2VudHMvZHNoLWh1Yg:0.0.1-rc.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/services/explorer.tsView on unpkg