@marecgents/dsh-hub@0.0.2-rc.13
DeepSeek Harness desktop hub — Tauri 2.x shell + dsh web plugin layer. This npm package ships the plugin half (client UI + HTTP routes + cordis.patch.yml); the desktop shell ships as the NSIS installer (see build/).
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a real install-hook risk because it performs conditional global installs from selected registries. The observed behavior is not sufficient to establish malicious intent or a blocking AI-agent-control hijack.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation; separately, starting the DSH sidecar.
Impact
It can alter global npm tools without an explicit setup command and add the package to a DSH profile; no confirmed secret theft or remote code execution was found.
Mechanism
Automatic global dependency installation and guarded DSH profile registration.
AI rationale
The package has a real install-hook risk because it performs conditional global installs from selected registries. The observed behavior is not sufficient to establish malicious intent or a blocking AI-agent-control hijack.
Evidence
package.jsonscripts/postinstall.mjsscripts/assemble-profile.mjsbin/dsh-web-sidecar.mjslib/server/terminal-pty-api.jslib/server/host-guard.jslib/server/token.jsDSH_HOME/profiles/web/package.jsonDSH_HOME/profiles/web/node_modules/@marecgents/dsh-hub
Network endpoints4
registry.npmjs.org/registry.npmmirror.commirrors.huaweicloud.com/repository/npm/mirrors.cloud.tencent.com/npm/
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The automatic postinstall hook runs network probes and conditionally installs a global DSH CLI and pnpm.
- The hook selects from four registries, including third-party mirrors, before the global install.
- A runtime sidecar modifies the DSH web profile to register this package and create a junction.
- The package exposes a token-protected local PTY, so it can execute user-selected shells after guarded runtime startup.
Evidence against
- No credential harvesting, secret exfiltration, obfuscation, or remote payload execution was found.
- The profile mutation is invoked by the sidecar, not by the npm lifecycle hook.
- Runtime routes are gated by a launch environment marker, loopback host checks, origin checks, and a per-process token.
- The manifest has no runtime dependency on this package name, so there is no self-dependency lifecycle chain.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/dsh-web-sidecar.mjsView file
27L28: import { spawnSync } from 'node:child_process'
L29: import { existsSync } from 'node:fs'
High
Child Process
Package source references child process execution.
bin/dsh-web-sidecar.mjsView on unpkg · L27Findings
5 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/dsh-web-sidecar.mjs
HighShellbin/dsh-web-sidecar.mjs
HighCross File Remote Execution Contextscripts/build-installer.mjs
HighRuntime Package Installscripts/build-client.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/dsh-deps-install.ps1
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @marecgents/dsh-hub@0.0.2-rc.13.
See all versions of @marecgents/dsh-hub for other recorded verdicts.
- Review the evidence and your use of @marecgents/dsh-hub@0.0.2-rc.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.