registry / Credential exfiltration / @noob-stupid/dsh-plugin-console
@noob-stupid/dsh-plugin-console
DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirror
This report shows the evidence for @noob-stupid/dsh-plugin-console@0.5.108. 3 of 79 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 5h ago · by lpm-firewall-aiThe marketplace repository lookup automatically forwards a locally saved GitHub credential to hard-coded third-party proxy hosts. This is credential exfiltration to hosts outside GitHub, regardless of whether the official API request wins the race.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A repository lookup through the marketplace route when github-auth.json contains a token.
Impact
The proxy hosts can receive and potentially retain the user's GitHub bearer token, even when the official GitHub request succeeds.
Mechanism
The route passes the token to githubJson, which sends parallel API requests to official GitHub and mirror hosts with the same authorization header.
Attack narrative
When a user looks up a repository in the marketplace, the package reads the saved GitHub token and passes it into a GitHub API request. The HTTP layer races requests to hard-coded third-party proxies alongside the official API and forwards the original request options, including the Bearer token. The proxies therefore receive the credential without the user choosing or configuring them.
AI rationale
The marketplace repository lookup automatically forwards a locally saved GitHub credential to hard-coded third-party proxy hosts. This is credential exfiltration to hosts outside GitHub, regardless of whether the official API request wins the race.
Evidence
lib/server/domain/install.jslib/server/infra/http.jslib/server/routes/market.jsgithub-auth.json under dshHome() (read)
Network endpoints3
api.github.comghproxy.net/https://api.github.comghfast.top/https://api.github.com
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package reads a GitHub token from github-auth.json under dshHome().
- GitHub HTTP requests place the token in a Bearer authorization header.
- GitHub API mirror requests reuse the original request options, including its token.
- The hard-coded API mirrors are ghproxy.net and ghfast.top.
- The repository metadata route reads the saved token and passes it to githubJson for a repository lookup.
Evidence against
- The GitHub repository lookup is part of the package’s plugin marketplace feature.
- The package’s only lifecycle script runs a package.json BOM check before publishing.
- The flagged upgrade task is created through a user-facing upgrade route and is configured as a one-time task.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
19 flaggedlib/server/domain/install-verify.jsView file
50try {
L51: const manifest = JSON.parse(readFileSync(join(profileDir, 'package.json'), 'utf8'))
L52: const bundles = manifest?.dsh?.profile?.bundles
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/server/domain/install-verify.jsView on unpkg · L50lib/server/domain/framework.jsView file
4Trigger-reachable persistence chain: manifest.main -> lib/index.js -> lib/server/domain/framework.js
L4: import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync, copyFileSync } from 'node:fs'
L5: import { execFile } from 'node:child_process'
L6: import { dirname, join, basename, resolve } from 'node:path'
...
L19: try {
L20: const requireLocal = createRequire(join(pluginRoot(), 'package.json'))
L21: return join(dirname(requireLocal.resolve('@deepseek-ai/dsh/package.json')), 'lib', 'bin.js')
...
L39: * npm 的 cache 位置本来就是用户配置（把 cache 指到别的盘是常见做法），所以按 npm 自己的
L40: * 配置来源读取：环境变量 npm[redacted] / NPM_CONFIG_CACHE，以及用户级 ~/.npmrc 的 `cache=`。
L41: * （原实现把开发机上某个盘符下的 `node_cache\_npx` 直接写进源码，随 npm 发给所有用户。） */
...
L45: if (typeof value !== 'string') return
L46: const dir = value.tri
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
lib/server/domain/framework.jsView on unpkg · L4•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = lib/server/domain/framework.js
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server/domain/framework.jsView on unpkg4import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync, copyFileSync } from 'node:fs'
L5: import { execFile } from 'node:child_process'
L6: import { dirname, join, basename, resolve } from 'node:path'
...
L19: try {
L20: const requireLocal = createRequire(join(pluginRoot(), 'package.json'))
L21: return join(dirname(requireLocal.resolve('@deepseek-ai/dsh/package.json')), 'lib', 'bin.js')
...
L39: * npm 的 cache 位置本来就是用户配置（把 cache 指到别的盘是常见做法），所以按 npm 自己的
L40: * 配置来源读取：环境变量 npm[redacted] / NPM_CONFIG_CACHE，以及用户级 ~/.npmrc 的 `cache=`。
L41: * （原实现把开发机上某个盘符下的 `node_cache\_npx` 直接写进源码，随 npm 发给所有用户。） */
...
L45: if (typeof value !== 'string') return
L46: const dir = value.trim().replace(/^["']|["']$/gu, '').replace(/^~(?=[\\/]|$)/u, homedir())
L47: if (dir !== '') roots.push
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
lib/server/domain/framework.jsView on unpkg · L4lib/server/routes/framework.jsView file
5import { writeFile } from 'node:fs/promises'
L6: import { execFile } from 'node:child_process'
L7: import { dirname, join, resolve, basename } from 'node:path'
...
L30: * Electron 外壳只留下 `crash-…-host.log: dsh desktop host exited with 4294967295`（真机 20:28）。
L31: * 命中时：**不 kill、不 spawn、不建 schtasks**，返回结构化 409 + 面向用户短句。
L32: * 返回 true = 已拒绝（调用方直接 return）；false = 独立 `dsh web` 实例，原路径一字不改。
...
L104: let raw = readFileSync(f, 'utf8')
L105: if (raw.charCodeAt(0) === 0xFEFF) raw = raw.slice(1)
L106: const [st, ...rest] = raw.split('|')
...
L129: const localRequire = createRequire(ctx.baseUrl ?? 'file:///')
L130: current = JSON.parse(readFileSync(localRequire.resolve('@deepseek-ai/dsh/package.json'), 'utf8')).version ?? null
L131: } catch {}
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
lib/server/routes/framework.jsView on unpkg · L5•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = lib/server/routes/framework.js
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server/routes/framework.jsView on unpkglib/server/routes/framework-upgrade.jsView file
2Trigger-reachable chain: manifest.main -> lib/index.js -> lib/server/routes/framework-upgrade.js
L2: // 分层 Step 8b：从 lib/index.js 的 handle() 原样搬出（只搬移未改逻辑）。这个 handler 内置大段
L3: // PowerShell 脚本模板，是守卫「单文件 ≤ 600 行」的受限例外（见 SIZE_EXCEPTIONS），待抽包阶段撤销。
L4:
...
L57: let dshDir = null
L58: // 面板自报名（自报名一致性校验用）：从插件自身 package.json 读，与部署目录比对
L59: let selfName = null
...
L63: // selfName 一直是 null，生成脚本时只能退回 hardcode 兜底；现在走真实包根）
L64: const selfPkg = JSON.parse(readFileSync(join(pluginRoot(), 'package.json'), 'utf8'))
L65: selfName = typeof selfPkg.name === 'string' ? selfPkg.name : null
...
L89: }
L90: // 平台守卫（2026-09-29 改错）：本通道 = schtasks.exe + PowerShell，只有 win32 有；判据与文案见
L91: // domain/framework.js#platformUpgradeRefusal。放在入参校验之后、任何副作用之前 —— 绝不假成功。
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
lib/server/routes/framework-upgrade.jsView on unpkg · L2•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = lib/server/routes/framework-upgrade.js
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server/routes/framework-upgrade.jsView on unpkgscripts/fw-watchdog.cmdView file
•path = scripts/fw-watchdog.cmd
kind = build_helper
sizeBytes = 1371
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/fw-watchdog.cmdView on unpkglib/server/domain/install-diagnose.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/server/domain/install-diagnose.js#virtual:normalized:round1View on unpkglib/server/domain/ai-run.jsView file
•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = lib/server/domain/ai-run.js
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server/domain/ai-run.jsView on unpkglib/server/domain/repoland.jsView file
•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = lib/server/domain/repoland.js
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server/domain/repoland.jsView on unpkglib/server/routes/components.jsView file
•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = lib/server/routes/components.js
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server/routes/components.jsView on unpkglib/server/domain/ai.jsView file
•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = lib/server/domain/ai.js
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server/domain/ai.jsView on unpkglib/server/domain/archive-source.jsView file
•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = lib/server/domain/archive-source.js
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server/domain/archive-source.jsView on unpkglib/server/domain/compat.jsView file
•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = lib/server/domain/compat.js
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server/domain/compat.jsView on unpkglib/server/infra/exec.jsView file
•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = lib/server/infra/exec.js
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server/infra/exec.jsView on unpkglib/server/infra/http.jsView file
•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = lib/server/infra/http.js
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/server/infra/http.jsView on unpkgscripts/build-index.cjsView file
•matchType = normalized_sha256
matchedPackage = @noob-stupid/dsh-plugin-console@0.5.95
matchedPath = scripts/build-index.cjs
matchedIdentity = npm:[redacted]:0.5.95
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/build-index.cjsView on unpkgFindings
2 Critical14 High5 Medium6 Low
CriticalPersistence Backdoorlib/server/routes/framework.js
CriticalTrigger Reachable Dangerous Capabilitylib/server/routes/framework-upgrade.js
HighTrigger Reachable Persistencelib/server/domain/framework.js
HighSemantic Analysis Limitedlib/server/domain/install-diagnose.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/server/domain/ai-run.js
HighKnown Malware Source Similaritylib/server/domain/framework.js
HighKnown Malware Source Similaritylib/server/domain/repoland.js
HighKnown Malware Source Similaritylib/server/routes/components.js
HighKnown Malware Source Similaritylib/server/domain/ai.js
HighKnown Malware Source Similaritylib/server/domain/archive-source.js
HighKnown Malware Source Similaritylib/server/domain/compat.js
HighKnown Malware Source Similaritylib/server/infra/exec.js
HighKnown Malware Source Similaritylib/server/infra/http.js
HighKnown Malware Source Similaritylib/server/routes/framework-upgrade.js
HighKnown Malware Source Similaritylib/server/routes/framework.js
HighKnown Malware Source Similarityscripts/build-index.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/server/domain/framework.js
MediumShips Build Helperscripts/fw-watchdog.cmd
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/server/domain/install-verify.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @noob-stupid/dsh-plugin-console@0.5.108.
The versions list below shows the verdict for each recorded version.
- Avoid installing @noob-stupid/dsh-plugin-console@0.5.108. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
79 known versions0.5.108latestshownMaliciousCredential ExfiltrationBlockPublishedNov 4, 2026, 1:49 PM0.5.106MaliciousCredential ExfiltrationBlockPublishedNov 4, 2026, 12:13 PM0.5.105Clean—AllowPublishedNov 4, 2026, 11:43 AM0.5.104Clean—AllowPublishedNov 4, 2026, 10:30 AM0.5.102Clean—AllowPublishedNov 4, 2026, 6:19 AM0.5.100Clean—AllowPublishedNov 3, 2026, 4:12 AM0.5.99Clean—AllowPublishedNov 2, 2026, 3:30 PM0.5.98Clean—AllowPublishedOct 29, 2026, 8:17 AM0.5.97Clean—AllowPublishedOct 29, 2026, 6:46 AM0.5.95MaliciousCredential ExfiltrationBlockPublishedOct 28, 2026, 11:21 AM0.5.94Clean—AllowPublishedOct 28, 2026, 5:43 AM0.5.93Clean—AllowPublishedOct 27, 2026, 1:39 PM0.5.92Clean—AllowPublishedOct 19, 2026, 8:17 AM0.5.87Clean—AllowPublishedOct 18, 2026, 12:32 PM0.5.85Clean—AllowPublishedOct 18, 2026, 10:23 AM0.5.77Clean—AllowPublishedOct 18, 2026, 6:16 AM0.5.71Clean—AllowPublishedOct 18, 2026, 5:16 AM0.5.67Clean—AllowPublishedOct 18, 2026, 3:50 AM0.5.60Clean—AllowPublishedOct 18, 2026, 2:55 AM0.5.59Clean—AllowPublishedOct 17, 2026, 4:16 PM0.5.57Clean—AllowPublishedOct 17, 2026, 3:39 PM0.5.56Clean—AllowPublishedOct 17, 2026, 2:58 PM0.5.55Clean—AllowPublishedOct 17, 2026, 2:30 PM0.5.54Clean—AllowPublishedOct 17, 2026, 12:34 PM0.5.51Clean—AllowPublishedOct 14, 2026, 1:26 PM0.5.50Clean—AllowPublishedOct 14, 2026, 9:32 AM0.5.49Clean—AllowPublishedOct 14, 2026, 6:34 AM0.5.47Clean—AllowPublishedOct 13, 2026, 10:24 AM0.5.46Clean—AllowPublishedOct 13, 2026, 7:50 AM0.5.45Clean—AllowPublishedOct 11, 2026, 3:45 PM0.5.44Clean—AllowPublishedOct 10, 2026, 8:50 AM0.5.43Clean—AllowPublishedOct 8, 2026, 3:20 AM0.5.37Clean—AllowPublishedOct 3, 2026, 7:02 PM0.5.34Clean—AllowPublishedOct 1, 2026, 7:38 AM0.5.33Clean—AllowPublishedOct 1, 2026, 6:29 AM0.5.32Clean—AllowPublishedSep 29, 2026, 5:22 AM0.5.31Clean—AllowPublishedSep 28, 2026, 7:16 PM0.5.28Clean—AllowPublishedSep 27, 2026, 2:39 PM0.5.27Clean—AllowPublishedSep 27, 2026, 12:19 PM0.5.24Clean—AllowPublishedSep 27, 2026, 8:39 AM0.5.23Clean—AllowPublishedSep 27, 2026, 7:10 AM0.5.22Clean—AllowPublishedSep 27, 2026, 5:56 AM0.5.21Clean—AllowPublishedSep 27, 2026, 5:22 AM0.5.20Clean—AllowPublishedSep 27, 2026, 5:03 AM0.5.19Clean—AllowPublishedSep 26, 2026, 9:07 PM0.5.17Suspicious—WarnPublishedSep 26, 2026, 3:59 PM0.5.14Clean—AllowPublishedSep 26, 2026, 11:01 AM0.5.12Clean—AllowPublishedSep 25, 2026, 5:12 PM0.3.65Clean—AllowPublishedSep 23, 2026, 10:14 AM0.3.63Clean—AllowPublishedSep 22, 2026, 9:11 AM0.3.58Clean—AllowPublishedSep 22, 2026, 1:32 AM0.3.57SuspiciousCredential ExfiltrationWarnPublishedSep 21, 2026, 11:51 AM0.3.54Clean—AllowPublishedSep 20, 2026, 2:37 PM0.3.53Clean—AllowPublishedSep 20, 2026, 8:34 AM0.3.52SuspiciousCredential ExfiltrationWarnPublishedSep 20, 2026, 7:59 AM0.3.51Clean—AllowPublishedSep 20, 2026, 6:26 AM0.3.50Clean—AllowPublishedSep 20, 2026, 6:05 AM0.3.49Clean—AllowPublishedSep 20, 2026, 4:26 AM0.3.48Clean—AllowPublishedSep 20, 2026, 2:44 AM0.3.47Clean—AllowPublishedSep 17, 2026, 2:19 PM0.3.46Clean—AllowPublishedSep 14, 2026, 1:56 PM0.3.33SuspiciousAI-agent capability abuseWarnPublishedSep 10, 2026, 8:23 AM0.3.32SuspiciousCredential ExfiltrationWarnPublishedSep 9, 2026, 4:35 AM0.3.31SuspiciousAgent extension lifecycle riskWarnPublishedSep 8, 2026, 12:58 PM0.3.29Clean—AllowPublishedSep 6, 2026, 9:00 AM0.3.27SuspiciousAI-agent capability abuseWarnPublishedSep 4, 2026, 10:17 AM0.3.26Clean—AllowPublishedSep 3, 2026, 9:39 PM0.3.21Suspicious—WarnUnder ReviewAug 29, 2026, 2:24 PM0.3.20Suspicious—WarnUnder ReviewAug 26, 2026, 11:27 AM0.3.19Clean—AllowPublishedAug 23, 2026, 4:07 PM0.3.18Suspicious—WarnUnder ReviewAug 23, 2026, 7:33 AM0.3.16Suspicious—WarnUnder ReviewAug 22, 2026, 1:26 PM0.3.15Suspicious—WarnUnder ReviewAug 22, 2026, 10:55 AM0.3.14Suspicious—WarnUnder ReviewAug 22, 2026, 10:36 AM0.3.13Clean—AllowPublishedAug 21, 2026, 8:08 PM0.3.12Suspicious—WarnUnder ReviewAug 21, 2026, 7:41 PM0.3.11Suspicious—WarnUnder ReviewAug 21, 2026, 7:15 PM0.3.9Suspicious—WarnUnder ReviewAug 21, 2026, 5:38 PM0.3.8Suspicious—WarnUnder ReviewAug 21, 2026, 5:07 PM