registry / @noob-stupid/dsh-plugin-console / 0.5.33
@noob-stupid/dsh-plugin-console@0.5.33
DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirror
AI Security Review
scanned 24d ago · by lpm-firewall-aiSource inspection shows no install-time execution trigger, and the flagged persistence behavior is tied to framework maintenance handlers. The scanner findings do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A request handled by the framework upgrade or rollback routes.
Impact
These operations can stop and relaunch the DSH service and alter its framework installation when the feature is invoked; no malicious attack impact was established.
Mechanism
The handlers prepare upgrade or rollback scripts and use Windows task scheduling or PowerShell to run them; cleanup targets specifically named DSH tasks.
AI rationale
Source inspection shows no install-time execution trigger, and the flagged persistence behavior is tied to framework maintenance handlers. The scanner findings do not establish malicious behavior.
Evidence
package.jsonlib/server/routes/framework.jslib/server/routes/framework-upgrade.jslib/server/domain/framework.jslib/server/domain/install-diagnose.js
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines `prepublishOnly` as a BOM check; it has no install lifecycle hook.
- Framework upgrade and rollback behavior is implemented in request handlers and supports the package’s stated upgrade purpose.
- The flagged scheduled-task cleanup queries tasks and deletes only names matching DSH upgrade, rollback, or restart patterns.
- Install diagnosis is a pure classification module with no I/O or process access.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedlib/server/domain/install-verify.jsView file
50try {
L51: const manifest = JSON.parse(readFileSync(join(profileDir, 'package.json'), 'utf8'))
L52: const bundles = manifest?.dsh?.profile?.bundles
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/server/domain/install-verify.jsView on unpkg · L50lib/server/domain/framework.jsView file
4Trigger-reachable persistence chain: manifest.main -> lib/index.js -> lib/server/domain/framework.js
L4: import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync, copyFileSync } from 'node:fs'
L5: import { execFile } from 'node:child_process'
L6: import { dirname, join, basename, resolve } from 'node:path'
...
L18: try {
L19: const requireLocal = createRequire(join(pluginRoot(), 'package.json'))
L20: return join(dirname(requireLocal.resolve('@deepseek-ai/dsh/package.json')), 'lib', 'bin.js')
...
L31: * npm 的 cache 位置本来就是用户配置（把 cache 指到别的盘是常见做法），所以按 npm 自己的
L32: * 配置来源读取：环境变量 npm[redacted] / NPM_CONFIG_CACHE，以及用户级 ~/.npmrc 的 `cache=`。
L33: * （原实现把开发机上某个盘符下的 `node_cache\_npx` 直接写进源码，随 npm 发给所有用户。） */
...
L37: if (typeof value !== 'string') return
L38: const dir = value.tri
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
lib/server/domain/framework.jsView on unpkg · L44import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync, copyFileSync } from 'node:fs'
L5: import { execFile } from 'node:child_process'
L6: import { dirname, join, basename, resolve } from 'node:path'
...
L18: try {
L19: const requireLocal = createRequire(join(pluginRoot(), 'package.json'))
L20: return join(dirname(requireLocal.resolve('@deepseek-ai/dsh/package.json')), 'lib', 'bin.js')
...
L31: * npm 的 cache 位置本来就是用户配置（把 cache 指到别的盘是常见做法），所以按 npm 自己的
L32: * 配置来源读取：环境变量 npm[redacted] / NPM_CONFIG_CACHE，以及用户级 ~/.npmrc 的 `cache=`。
L33: * （原实现把开发机上某个盘符下的 `node_cache\_npx` 直接写进源码，随 npm 发给所有用户。） */
...
L37: if (typeof value !== 'string') return
L38: const dir = value.trim().replace(/^["']|["']$/gu, '').replace(/^~(?=[\\/]|$)/u, homedir())
L39: if (dir !== '') roots.push
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
lib/server/domain/framework.jsView on unpkg · L4lib/server/routes/framework.jsView file
5import { writeFile } from 'node:fs/promises'
L6: import { execFile } from 'node:child_process'
L7: import { dirname, join, resolve } from 'node:path'
...
L24: * Electron 外壳只留下 `crash-…-host.log: dsh desktop host exited with 4294967295`（真机 20:28）。
L25: * 命中时：**不 kill、不 spawn、不建 schtasks**，返回结构化 409 + 面向用户短句。
L26: * 返回 true = 已拒绝（调用方直接 return）；false = 独立 `dsh web` 实例，原路径一字不改。
...
L62: let raw = readFileSync(f, 'utf8')
L63: if (raw.charCodeAt(0) === 0xFEFF) raw = raw.slice(1)
L64: const [st, ...rest] = raw.split('|')
...
L85: const localRequire = createRequire(ctx.baseUrl ?? 'file:///')
L86: current = JSON.parse(readFileSync(localRequire.resolve('@deepseek-ai/dsh/package.json'), 'utf8')).version ?? null
L87: } catch {}
Critical
Persistence Backdoor
Source writes persistence or remote-access backdoor material.
lib/server/routes/framework.jsView on unpkg · L5lib/server/routes/framework-upgrade.jsView file
2Trigger-reachable chain: manifest.main -> lib/index.js -> lib/server/routes/framework-upgrade.js
L2: // 分层 Step 8b：从 lib/index.js 的 handle() 原样搬出（只搬移未改逻辑）。这个 handler 内置大段
L3: // PowerShell 脚本模板，是守卫「单文件 ≤ 600 行」的受限例外（见 SIZE_EXCEPTIONS），待抽包阶段撤销。
L4:
...
L55: let dshDir = null
L56: // 面板自报名（自报名一致性校验用）：从插件自身 package.json 读，与部署目录比对
L57: let selfName = null
...
L61: // selfName 一直是 null，生成脚本时只能退回 hardcode 兜底；现在走真实包根）
L62: const selfPkg = JSON.parse(readFileSync(join(pluginRoot(), 'package.json'), 'utf8'))
L63: selfName = typeof selfPkg.name === 'string' ? selfPkg.name : null
...
L87: }
L88: // 平台守卫（2026-09-29 改错）：本通道 = schtasks.exe + PowerShell，只有 win32 有；判据与文案见
L89: // domain/framework.js#platformUpgradeRefusal。放在入参校验之后、任何副作用之前 —— 绝不假成功。
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
lib/server/routes/framework-upgrade.jsView on unpkg · L2lib/server/domain/install-diagnose.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/server/domain/install-diagnose.js#virtual:normalized:round1View on unpkgFindings
2 Critical2 High4 Medium6 Low
CriticalPersistence Backdoorlib/server/routes/framework.js
CriticalTrigger Reachable Dangerous Capabilitylib/server/routes/framework-upgrade.js
HighTrigger Reachable Persistencelib/server/domain/framework.js
HighSemantic Analysis Limitedlib/server/domain/install-diagnose.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencelib/server/domain/framework.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/server/domain/install-verify.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @noob-stupid/dsh-plugin-console@0.5.33.
See all versions of @noob-stupid/dsh-plugin-console for other recorded verdicts.
- Review the evidence and your use of @noob-stupid/dsh-plugin-console@0.5.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.