@marecgents/dsh-hub@0.0.2-rc.11
DeepSeek Harness desktop hub — Tauri 2.x shell + dsh web plugin layer. This npm package ships the plugin half (client UI + HTTP routes + cordis.patch.yml); the desktop shell ships as the NSIS installer (see build/).
AI Security Review
scanned 18d ago · by lpm-firewall-aiSource establishes separately invoked agent configuration mutation, which the review policy classifies as warning-only. The inspected behavior does not establish a block-eligible malicious chain.
Decision evidence
public snapshot- The profile assembler writes this package into DeepSeek's web-profile bundle configuration.
- The assembler also registers scoped plugins discovered in its bundled plugins directory.
- The sidecar invokes profile assembly with the selected DSH_HOME and package root.
- The automatic postinstall hook installs missing prerequisites; profile assembly is a separate helper.
- The plugin patch requires DSH_HUB_LAUNCHED to activate.
- No concrete credential exfiltration, obfuscated payload, or lifecycle self-dependency was established.
- Inspected postinstall cleanup targets legacy package shims and shortcuts rather than broad agent configuration.
Source & flagged code
14 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
bin/dsh-web-sidecar.mjsView on unpkg · L27Findings
Affected versions and remediation
This report applies to @marecgents/dsh-hub@0.0.2-rc.11.
See all versions of @marecgents/dsh-hub for other recorded verdicts.
- Review the evidence and your use of @marecgents/dsh-hub@0.0.2-rc.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.