@noob-stupid/dsh-plugin-console@0.3.57
DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe source shows a user-triggered setup path that can forward an existing DeepSeek key to a configurable endpoint without binding the key to the intended service. This warrants a warning; the inspected behavior does not establish automatic or covert exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user selects and runs the OpenViking setup steps.
Impact
If the configured API base is untrusted, OpenViking may send the DeepSeek key to that endpoint.
Mechanism
The plugin resolves a configurable API base and falls back to the stored DeepSeek key, then writes both into OpenViking’s configuration.
AI rationale
The source shows a user-triggered setup path that can forward an existing DeepSeek key to a configurable endpoint without binding the key to the intended service. This warrants a warning; the inspected behavior does not establish automatic or covert exfiltration.
Evidence
lib/index.js~/.dsh/.credentials.yaml~/.openviking/ov.conf
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- lib/index.js reads the existing DeepSeek API key from the user’s credentials file.
- A custom API base can be combined with that inherited key, and the resulting endpoint and key are written to OpenViking’s configuration.
- The configuration is part of an OpenViking setup plan that runs when the user selects its steps; this creates a conditional credential exposure risk if the custom endpoint is untrusted.
Evidence against
- package.json has no install lifecycle hook; its only publishing hook runs a BOM check.
- The OpenViking setup appears in an explicit setup plan, rather than running automatically when the package is installed or imported.
- The default API base is api.deepseek.com, the intended service for the inherited DeepSeek key.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedlib/index.jsView file
7* POST /plugin-console/search GitHub 仓库搜索（dsh-plugin 相关）
L8: * POST /plugin-console/repo 读取仓库的 package.json，判断是否可安装
L9: * POST /plugin-console/install 安装 npm 包（或 git 仓库）并追加启用条目
...
L16: import { readFileSync, writeFileSync, existsSync, statSync, rmSync, readdirSync, mkdirSync, copyFileSync, realpathSync, chmodSync } from 'node:fs'
L17: import { execFile, spawn } from 'node:child_process'
L18: import { promisify } from 'node:util'
...
L22: import { createRequire } from 'node:module'
L23: import { request as httpsRequest } from 'node:https'
L24:
...
L136: if (pkgPath === null) throw new Error('not found')
L137: const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
L138: return typeof pkg.dsh?.bundle?.patch === 'string'
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
lib/index.jsView on unpkg · L77Trigger-reachable chain: manifest.main -> lib/index.js
L7: * POST /plugin-console/search GitHub 仓库搜索（dsh-plugin 相关）
L8: * POST /plugin-console/repo 读取仓库的 package.json，判断是否可安装
L9: * POST /plugin-console/install 安装 npm 包（或 git 仓库）并追加启用条目
...
L16: import { readFileSync, writeFileSync, existsSync, statSync, rmSync, readdirSync, mkdirSync, copyFileSync, realpathSync, chmodSync } from 'node:fs'
L17: import { execFile, spawn } from 'node:child_process'
L18: import { promisify } from 'node:util'
...
L22: import { createRequire } from 'node:module'
L23: import { request as httpsRequest } from 'node:https'
L24:
...
L136: if (pkgPath === null) throw new Error('not found')
L137: const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
L138: return typeof pkg.dsh?.bundle?.patch === 'string
Findings
2 Critical1 High4 Medium5 Low
CriticalPersistence Backdoorlib/index.js
CriticalTrigger Reachable Dangerous Capabilitylib/index.js
HighTrigger Reachable Persistencelib/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @noob-stupid/dsh-plugin-console@0.3.57.
See all versions of @noob-stupid/dsh-plugin-console for other recorded verdicts.
- Review the evidence and your use of @noob-stupid/dsh-plugin-console@0.3.57 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.