@marecgents/dsh-hub@0.1.1
DeepSeek Harness desktop hub — Tauri 2.x shell + dsh web plugin layer. This npm package ships the plugin half (client UI + HTTP routes + cordis.patch.yml); the desktop shell ships as the NSIS installer (see build/).
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a concrete, automatic install-hook abuse risk because it changes globally installed tooling and chooses among registries. The reviewed source does not establish malicious data theft or remote code execution beyond the installed packages themselves.
Decision evidence
public snapshot- The automatic postinstall hook installs the separate @deepseek-ai/dsh CLI globally after probing registries.
- The same hook installs pnpm globally when absent, without an explicit user command.
- On Windows, postinstall also removes matching global shims and a desktop shortcut.
- No runtime dependency on this package itself was found.
- No source path harvests credentials or sends local data to a remote endpoint.
- The plugin runtime is gated by DSH_HUB_LAUNCHED, and its terminal API checks a token and origin.
Source & flagged code
8 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
bin/dsh-web-sidecar.mjsView on unpkg · L27Findings
Affected versions and remediation
This report applies to @marecgents/dsh-hub@0.1.1.
See all versions of @marecgents/dsh-hub for other recorded verdicts.
- Review the evidence and your use of @marecgents/dsh-hub@0.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.