@noob-stupid/dsh-plugin-console@0.5.98
DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirror
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged scheduling and filesystem behavior belongs to the package's framework upgrade and recovery features and is triggered through its local route. The only lifecycle script is a prepublish-only BOM check, and the reviewed route code includes local host and same-origin checks.
Decision evidence
public snapshot- The only lifecycle script is prepublishOnly, which runs a package.json BOM check.
- The framework upgrade handler performs the upgrade workflow through a route and uses a one-time scheduled task to run it.
- Startup cleanup targets stale tasks with DSH-specific upgrade, rollback, and restart names.
- Write routes require a local same-origin request.
- No malicious behavior was identified in the reviewed files.
- The package describes framework and plugin upgrade management, matching the reviewed upgrade, backup, rollback, and restart code.
Source & flagged code
8 flaggedPackage source references weak cryptographic algorithms.
lib/server/domain/install-verify.jsView on unpkg · L50This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/server/domain/framework.jsView on unpkgFindings
Affected versions and remediation
This report applies to @noob-stupid/dsh-plugin-console@0.5.98.
See all versions of @noob-stupid/dsh-plugin-console for other recorded verdicts.
- Review the evidence and your use of @noob-stupid/dsh-plugin-console@0.5.98 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.