registry / @marecgents/dsh-hub / 0.0.1-rc.9

@marecgents/dsh-hub@0.0.1-rc.9

DeepSeek Harness desktop hub — native desktop shell (WebView2) for dsh's Web UI with tray, theme sync, window-state memory and a right sidebar. Injects the shell + plugin page only when launched by this project (desktop shortcut or `dsh-hub` command).

AI Security Review

scanned 13h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation can globally install dsh/pnpm and create a desktop launcher. Running that launcher registers this package as a dsh web-profile bundle and starts a loopback desktop shell; no exfiltration endpoint was found.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall; then the created shortcut or dsh-hub command.

Impact

Unexpected install-time system changes and later opt-in agent-extension activation.

Mechanism

desktop launcher and gated dsh profile-bundle registration

Rationale

This is not concrete malicious behavior, but it has unconsented postinstall side effects and an explicit launcher that registers an agent-platform extension. The registration is gated to the package’s own launch path and no exfiltration was identified.

Evidence

package.jsonscripts/postinstall.mjsbin/launcher.mjscordis.patch.ymllib/index.jslib/services/workspace-api.jsbin/launcher.vbs

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

with false-positive risk.

@marecgents/dsh-hub@0.0.1-rc.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code