registry / @marecgents/dsh-hub / 0.1.0

@marecgents/dsh-hub@0.1.0

DeepSeek Harness desktop hub — Tauri 2.x shell + dsh web plugin layer. This npm package ships the plugin half (client UI + HTTP routes + cordis.patch.yml); the desktop shell ships as the NSIS installer (see build/).

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 125 file(s), 2.11 MB of source, external domains: 127.0.0.1, bellard.org, developer.mozilla.org, github.com, mirrors.cloud.tencent.com, mirrors.huaweicloud.com, nodejs.org, registry.npmjs.org, registry.npmmirror.com, rustup.rs, winlibs.com, www.w3.org

Source & flagged code

7 flagged

package.jsonView file

Lines 20-60json

20 },

21 "./cordis.patch.yml": "./cordis.patch.yml",

22 "./src/*": "./src/*",

23 "./package.json": "./package.json"

24 },

25 "files": [

26 "lib",

27 "src",

28 "bin",

29 "scripts",

30 "assets",

31 "cordis.patch.yml",

32 "README.md"

33 ],

34 "bin": {},

35 "scripts": {

36 "build": "tsc",

37 "build:client": "node ./scripts/build-client.mjs",

38 "build:installer": "node ./scripts/build-installer.mjs",

39 "prepack": "npm run build && npm run build:client",

40 "postinstall": "node ./scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "postuninstall": "node ./scripts/postuninstall.mjs",

42 "tauri:dev": "tauri dev",

43 "tauri:build": "tauri build",

44 "tauri:icon": "tauri icon",

45 "m1:check": "node scripts/check-tauri-conf.mjs",

46 "m1:ipc-smoke": "node scripts/ipc-smoke.mjs"

47 },

48 "dsh": {

49 "bundle": {

50 "patch": "./cordis.patch.yml"

51 },

52 "client": {

53 "platform": "web",

54 "inject": [

55 "@deepseek-ai/dsh-client-runtime",

56 "@deepseek-ai/dsh-client-locale",

57 "@deepseek-ai/dsh-client-ui-settings"

58 ]

59 }

60 },

bin/dsh-web-sidecar.mjsView file

Lines 7-71javascript

7 * ② 调用 scripts/assemble-profile.mjs（spawn node，传 DSH_HOME +

8 * DSH_HUB_PACKAGE_ROOT=<repo 根>）确保 web profile 装配（scoped bundle +

9 * junction 自愈，幂等）；

10 * ③ 探测/解析 node 路径：优先 DSH_HUB_NODE env → PATH 里 node →

scripts/build-installer.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * build-installer.mjs — dsh-hub 桌面壳一键打包（NSIS 安装器）。

4 *

5 * 职责（模块类别：Helper — 打包脚本）：

6 * 1. 动态检测工具链（Node / npm / cargo / rustup / MSVC vcvars64.bat / GNU gcc），

7 * 只报告、不硬编码任何路径（clone 任何人机器都能跑，工具位置因人而异）；

8 * 2. 前置检查与构建：node_modules 缺失时自动 npm install（提示可能慢），

9 * 然后依次执行 npm run build（host tsc → lib/）与 npm run build:client（client bundle）；

10 * 3. 打包：MSVC 模式在 vcvars64.bat 环境内执行 npm run tauri:build（= cargo tauri build，

scripts/build-client.mjsView file

Lines 76-107javascript

76 mkdirSync(targetScope, { recursive: true })

77 let linked = 0

78 for (const name of SDK_PACKAGES) {

79 const

scripts/dsh-deps-install.ps1View file

•path = scripts/dsh-deps-install.ps1 kind = build_helper sizeBytes = 15919 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/dsh-deps-install.ps1View on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/dsh-web-sidecar.mjsView file

27L28: import { spawnSync } from 'node:child_process' L29: import { existsSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/dsh-web-sidecar.mjsView on unpkg · L27

Findings

5 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/dsh-web-sidecar.mjs

HighShellbin/dsh-web-sidecar.mjs

HighCross File Remote Execution Contextscripts/build-installer.mjs

HighRuntime Package Installscripts/build-client.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/dsh-deps-install.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @marecgents/dsh-hub@0.1.0.

See all versions of @marecgents/dsh-hub for other recorded verdicts.

Review the evidence and your use of @marecgents/dsh-hub@0.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-30 02:45:06.306Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.