Loading npm security reports…

@marecgents/dsh-hub@0.1.4: AI-agent control-surface risk | LPM Firewall

registry / @marecgents/dsh-hub / 0.1.4

@marecgents/dsh-hub@0.1.4

DeepSeek Harness desktop hub — Tauri 2.x shell + dsh web plugin layer. This npm package ships the plugin half (client UI + HTTP routes + cordis.patch.yml); the desktop shell ships as the NSIS installer (see build/).

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing this package automatically changes the global environment. It can install an external AI-agent CLI and pnpm from a selected registry, then removes legacy global and desktop artifacts.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install, which runs postinstall automatically.

Impact

A dependency installation can alter the user's global agent and package-management toolchain without an explicit command.

Mechanism

Lifecycle-driven global package installation and host file deletion.

Policy narrative

The package declares an automatic postinstall hook. On installation, it probes several registries and, if its prerequisite check fails, runs a global installation of @deepseek-ai/dsh; it separately installs pnpm globally when missing. The hook also removes selected files in the global npm prefix and may delete a desktop shortcut. This mutates a broad external AI-agent and package-management control surface without requiring the user to invoke a setup command.

Rationale

The automatic lifecycle hook performs unconsented global installation of a separate AI-agent CLI and package manager, plus host cleanup. This is concrete install-time control-surface mutation, not a package-local build step.

Evidence

package.jsonscripts/postinstall.mjs

Network endpoints4

registry.npmjs.org/registry.npmmirror.commirrors.huaweicloud.com/repository/npm/

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/dsh-web-sidecar.mjsView file

27L28: import { spawnSync } from 'node:child_process' L29: import { existsSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/dsh-web-sidecar.mjsView on unpkg · L27

51* Query `npm prefix -g`. On Windows npm is a .cmd shim, so it goes through L52: * cmd.exe (CREATE_NO_WINDOW via windowsHide). Result is cached per run. L53: * @returns {string|null} npm global prefix, or null when unavailable.

High

Shell

Package source references shell execution.

bin/dsh-web-sidecar.mjsView on unpkg · L51

scripts/build-installer.mjsView file

19Cross-file remote execution chain: scripts/build-installer.mjs spawns lib/client.js; helper contains network access plus dynamic code execution. L19: * L20: * 依赖：仅 Node 内置模块（child_process / crypto / fs / path / url），不引第三方包。 L21: * Windows 路径含空格一律用 spawnSync 参数数组（不拼 shell 字符串）， ... L37: const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url))) L38: const IS_WIN = process.platform === 'win32' L39: const COMSPEC = process.env.ComSpec || 'cmd.exe' L40: const DRY_RUN = process.argv.includes('--dry-run') || process.argv.includes('-n') L41: L42: const useColor = !!process.stdout.isTTY && !process.env.NO_COLOR L43: const C = { ... L247: const tips = [] L248: if (!d.nodeVersion) tips.push('Node.js ≥ 24：https://nodejs.org（含 npm）')

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/build-installer.mjsView on unpkg · L19

scripts/build-client.mjsView file

96linkSdk() L97: const run = spawnSync('npx', ['tsdown'], { L98: cwd: PACKAGE_ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-client.mjsView on unpkg · L96

scripts/dsh-deps-install.ps1View file

•path = scripts/dsh-deps-install.ps1 kind = build_helper sizeBytes = 15919 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/dsh-deps-install.ps1View on unpkg

cordis.patch.ymlView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cordis.patch.ymlView on unpkg

lib/services/pty-manager.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @marecgents/dsh-hub@0.1.3 matchedIdentity = npm:QG1hcmVjZ2VudHMvZHNoLWh1Yg:0.1.3 similarity = 0.686 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/services/pty-manager.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 },

21 "./cordis.patch.yml": "./cordis.patch.yml",

22 "./src/*": "./src/*",

23 "./package.json": "./package.json"

24 },

25 "files": [

26 "lib",

27 "src",

28 "bin",

29 "scripts",

30 "assets",

31 "cordis.patch.yml",

32 "README.md"

33 ],

34 "bin": {},

35 "scripts": {

36 "build": "tsc && tsc -p tsconfig.client.json",

37 "build:client": "node ./scripts/build-client.mjs",

38 "build:installer": "node ./scripts/build-installer.mjs",

39 "prepack": "npm run build && npm run build:client",

40 "postinstall": "node ./scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "postuninstall": "node ./scripts/postuninstall.mjs",

42 "tauri:dev": "tauri dev",

43 "tauri:build": "tauri build",

44 "tauri:icon": "tauri icon",

45 "m1:check": "node scripts/check-tauri-conf.mjs",

46 "m1:ipc-smoke": "node scripts/ipc-smoke.mjs",

47 "prepare": "node scripts/git-hooks.mjs install"

48 },

49 "dsh": {

50 "bundle": {

51 "patch": "./cordis.patch.yml"

52 },

53 "client": {

54 "platform": "web",

55 "inject": [

56 "@deepseek-ai/dsh-client-runtime",

57 "@deepseek-ai/dsh-client-locale",

58 "@deepseek-ai/dsh-client-ui-settings"

59 ]

60 }

bin/dsh-web-sidecar.mjsView file

Lines 7-71javascript

7 * ② 调用 scripts/assemble-profile.mjs（spawn node，传 DSH_HOME +

8 * DSH_HUB_PACKAGE_ROOT=<repo 根>）确保 web profile 装配（scoped bundle +

9 * junction 自愈，幂等）；

10 * ③ 探测/解析 node 路径：优先 DSH_HUB_NODE env → PATH 里 node →

scripts/build-installer.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * build-installer.mjs — dsh-hub 桌面壳一键打包（NSIS 安装器）。

4 *

5 * 职责（模块类别：Helper — 打包脚本）：

6 * 1. 动态检测工具链（Node / npm / cargo / rustup / MSVC vcvars64.bat / GNU gcc），

7 * 只报告、不硬编码任何路径（clone 任何人机器都能跑，工具位置因人而异）；

8 * 2. 前置检查与构建：node_modules 缺失时自动 npm install（提示可能慢），

9 * 然后依次执行 npm run build（host tsc → lib/）与 npm run build:client（client bundle）；

10 * 3. 打包：MSVC 模式在 vcvars64.bat 环境内执行 npm run tauri:build（= cargo tauri build，

scripts/build-client.mjsView file

Lines 76-107javascript

76 mkdirSync(targetScope, { recursive: true })

77 let linked = 0

78 for (const name of SDK_PACKAGES) {

79 const

scripts/dsh-deps-install.ps1View file

•path = scripts/dsh-deps-install.ps1 kind = build_helper sizeBytes = 15919 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/dsh-deps-install.ps1View on unpkg

cordis.patch.ymlView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cordis.patch.ymlView on unpkg

lib/services/pty-manager.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @marecgents/dsh-hub@0.1.3 matchedIdentity = npm:QG1hcmVjZ2VudHMvZHNoLWh1Yg:0.1.3 similarity = 0.686 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/services/pty-manager.jsView on unpkg