@noob-stupid/dsh-plugin-console@0.5.92
DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirror
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no install-time execution hook, and its prepublishOnly script only checks for a package.json BOM. The persistence-related findings are tied to explicit framework operations or a watchdog installation command, so the inspected source does not support a malicious verdict.
Decision evidence
public snapshot- package.json exposes lib/index.js and has only a prepublishOnly BOM check; it defines no install lifecycle hook.
- The flagged framework logic records version state and backs up the profile during framework upgrade detection.
- The watchdog task is installed through an explicitly run PowerShell command; its status and uninstall modes are also explicit.
- The watchdog checks whether the desktop host has stopped and invokes the package's preflight repair helper; it does not automatically install itself.
- The flagged domain modules describe local audits, contract checks, registry version lookups, explicit build approvals, and profile dependency management.
- Framework upgrade and rollback routes can create one-time scheduled tasks and launch scripts after a user invokes those operations.
- The package includes an optional watchdog helper that can create a persistent scheduled task when explicitly run.
Source & flagged code
8 flaggedPackage source references weak cryptographic algorithms.
lib/server/domain/install-verify.jsView on unpkg · L50This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/server/domain/framework.jsView on unpkgFindings
Affected versions and remediation
This report applies to @noob-stupid/dsh-plugin-console@0.5.92.
See all versions of @noob-stupid/dsh-plugin-console for other recorded verdicts.
- Review the evidence and your use of @noob-stupid/dsh-plugin-console@0.5.92 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.