@noob-stupid/dsh-plugin-console@0.3.33
DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a real, high-impact agent-management capability with credential access and command execution, but the inspected source ties it to explicit runtime console actions and confirmation. No automatic npm lifecycle attack or covert exfiltration was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user operates the plugin console and explicitly confirms an AI deployment plan.
Impact
A user-approved plan can modify the DSH profile and user-scoped component files, install software, and start services.
Mechanism
User-confirmed package installation, file writing, downloads, and command execution through DSH runtime routes.
AI rationale
This is a real, high-impact agent-management capability with credential access and command execution, but the inspected source ties it to explicit runtime console actions and confirmation. No automatic npm lifecycle attack or covert exfiltration was found.
Evidence
lib/index.js~/.dsh/.credentials.yaml~/.dsh/plugin-console/ai-empower.jsonDSH profile directory
Network endpoints4
api.deepseek.commirrors.aliyun.comregistry.npmmirror.comhf-mirror.com
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The runtime entrypoint exposes a web-server plugin management control surface.
- It reads the DSH DeepSeek API credential from the user home directory.
- AI deployment can install packages, write files, download content, and execute approved commands.
- Deployment execution is reachable through the plugin's runtime HTTP routes.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its only lifecycle hook is prepublishOnly.
- The package has no runtime dependency on itself.
- AI deployment requires a prepared plan and an explicit confirmed flag before execution.
- Command and write actions include allowlist checks.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedlib/index.jsView file
569maxBuffer: 4 * 1024 * 1024,
L570: env: { ...process.env, COREPACK_NPM_REGISTRY: 'https://registry.npmmirror.com', GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never' },
L571: }
...
L578: const cmd = `${JSON.stringify('corepack')} ${args.map((arg) => JSON.stringify(arg)).join(' ')}`
L579: await execFileAsync(process.env.ComSpec ?? 'cmd.exe', ['/d', '/s', '/c', cmd], opts)
L580: return
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
lib/index.jsView on unpkg · L5697* POST /plugin-console/search GitHub 仓库搜索（dsh-plugin 相关）
L8: * POST /plugin-console/repo 读取仓库的 package.json，判断是否可安装
L9: * POST /plugin-console/install 安装 npm 包（或 git 仓库）并追加启用条目
...
L16: import { readFileSync, writeFileSync, existsSync, statSync, rmSync, readdirSync, mkdirSync, copyFileSync } from 'node:fs'
L17: import { execFile, spawn } from 'node:child_process'
L18: import { promisify } from 'node:util'
...
L22: import { createRequire } from 'node:module'
L23: import { request as httpsRequest } from 'node:https'
L24:
...
L136: if (pkgPath === null) throw new Error('not found')
L137: const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
L138: return typeof pkg.dsh?.bundle?.patch === 'string'
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
lib/index.jsView on unpkg · L7Findings
3 Critical4 High4 Medium5 Low
CriticalSame File Env Network Executionlib/index.js
CriticalPersistence Backdoorlib/index.js
CriticalTrigger Reachable Dangerous Capabilitylib/index.js
HighChild Processlib/index.js
HighShelllib/index.js
HighTrigger Reachable Persistencelib/index.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @noob-stupid/dsh-plugin-console@0.3.33.
See all versions of @noob-stupid/dsh-plugin-console for other recorded verdicts.
- Review the evidence and your use of @noob-stupid/dsh-plugin-console@0.3.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.