@noob-stupid/dsh-plugin-console@0.5.97
DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirror
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s install lifecycle only checks package.json formatting. The flagged scheduled-task and framework-modification behavior supports its framework-management purpose and is triggered by a local request or an explicit installer command.
Decision evidence
public snapshot- The only lifecycle script is prepublishOnly, which runs a package.json BOM check.
- The framework-upgrade operation is registered as an explicit POST route and runs its upgrade workflow when requested.
- The watchdog installer documents explicit PowerShell commands for installing or running it; it is not an install lifecycle hook.
- Startup cleanup targets only DSH framework and restart scheduled tasks, and deletes matching stale tasks.
- Framework version checks fetch public package metadata from registry.npmmirror.com.
Source & flagged code
8 flaggedPackage source references weak cryptographic algorithms.
lib/server/domain/install-verify.jsView on unpkg · L50This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/server/domain/framework.jsView on unpkgFindings
Affected versions and remediation
This report applies to @noob-stupid/dsh-plugin-console@0.5.97.
See all versions of @noob-stupid/dsh-plugin-console for other recorded verdicts.
- Review the evidence and your use of @noob-stupid/dsh-plugin-console@0.5.97 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.