@marecgents/dsh-hub@0.0.2-rc.17
DeepSeek Harness desktop hub — Tauri 2.x shell + dsh web plugin layer. This npm package ships the plugin half (client UI + HTTP routes + cordis.patch.yml); the desktop shell ships as the NSIS installer (see build/).
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic global installs and registry probing justify a warning for install-hook abuse. The inspected source does not establish malicious intent or a concrete exfiltration or takeover chain.
Decision evidence
public snapshot- Its automatic postinstall hook can globally install the DSH CLI and pnpm.
- The hook probes four package registries, including third-party mirrors, before choosing a download source.
- Its local terminal feature spawns an operating-system shell, although the route requires loopback host, token, and origin checks.
- No credential harvesting, secret upload, remote payload execution, or self-dependency was found.
- The plugin exits without registering features unless its desktop-launch environment flag is set.
- The terminal routes enforce loopback-host and per-process token checks.
Source & flagged code
7 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
bin/dsh-web-sidecar.mjsView on unpkg · L27Findings
Affected versions and remediation
This report applies to @marecgents/dsh-hub@0.0.2-rc.17.
See all versions of @marecgents/dsh-hub for other recorded verdicts.
- Review the evidence and your use of @marecgents/dsh-hub@0.0.2-rc.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.