@noob-stupid/dsh-plugin-console@0.3.32
DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.
AI Security Review
scanned 24d ago · by lpm-firewall-aiSource inspection found conditional forwarding of the existing DSH API key into OpenViking configuration that can use a custom endpoint. This warrants a warning, but the inspected evidence does not establish a direct exfiltration operation or malicious intent.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user starts an OpenViking installation and has custom VLM endpoint configuration without its own API key.
Impact
The downstream service may send the DSH credential to the configured endpoint; the inspected excerpts do not establish a direct network send by this package.
Mechanism
The integration falls back to the DSH credential and writes the key and configured endpoint into OpenViking configuration.
AI rationale
Source inspection found conditional forwarding of the existing DSH API key into OpenViking configuration that can use a custom endpoint. This warrants a warning, but the inspected evidence does not establish a direct exfiltration operation or malicious intent.
Evidence
lib/index.js
Network endpoints2
api.deepseek.com127.0.0.1:1933
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest’s only lifecycle hook is `prepublishOnly`, which runs a package BOM check.
- The plugin reads `DEEPSEEK_API_KEY` from the user’s DSH credentials file.
- When custom VLM configuration supplies an endpoint, the code can still fall back to that DSH key and place both in OpenViking’s configuration.
- OpenViking installation is started by an install job; credential exposure is conditional on that feature being invoked and custom endpoint configuration.
Evidence against
- No automatic install-time hook is present in the manifest.
- The credential handling is tied to the OpenViking integration, and the source excerpt shows no direct network send by this package.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedlib/index.jsView file
569maxBuffer: 4 * 1024 * 1024,
L570: env: { ...process.env, COREPACK_NPM_REGISTRY: 'https://registry.npmmirror.com', GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never' },
L571: }
...
L578: const cmd = `${JSON.stringify('corepack')} ${args.map((arg) => JSON.stringify(arg)).join(' ')}`
L579: await execFileAsync(process.env.ComSpec ?? 'cmd.exe', ['/d', '/s', '/c', cmd], opts)
L580: return
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
lib/index.jsView on unpkg · L5697* POST /plugin-console/search GitHub 仓库搜索（dsh-plugin 相关）
L8: * POST /plugin-console/repo 读取仓库的 package.json，判断是否可安装
L9: * POST /plugin-console/install 安装 npm 包（或 git 仓库）并追加启用条目
...
L16: import { readFileSync, writeFileSync, existsSync, statSync, rmSync, readdirSync, mkdirSync, copyFileSync } from 'node:fs'
L17: import { execFile, spawn } from 'node:child_process'
L18: import { promisify } from 'node:util'
...
L22: import { createRequire } from 'node:module'
L23: import { request as httpsRequest } from 'node:https'
L24:
...
L136: if (pkgPath === null) throw new Error('not found')
L137: const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
L138: return typeof pkg.dsh?.bundle?.patch === 'string'
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
lib/index.jsView on unpkg · L7Findings
3 Critical4 High4 Medium5 Low
CriticalSame File Env Network Executionlib/index.js
CriticalPersistence Backdoorlib/index.js
CriticalTrigger Reachable Dangerous Capabilitylib/index.js
HighChild Processlib/index.js
HighShelllib/index.js
HighTrigger Reachable Persistencelib/index.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @noob-stupid/dsh-plugin-console@0.3.32.
See all versions of @noob-stupid/dsh-plugin-console for other recorded verdicts.
- Review the evidence and your use of @noob-stupid/dsh-plugin-console@0.3.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.