registry / deepseek-pp-shell-host / 1.11.1

deepseek-pp-shell-host@1.11.1

Native Messaging Shell MCP host installer for DeepSeek++

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 106 KB of source, external domains: d.officecli.ai, github.com

Source & flagged code

4 flagged

native/process-provider.mjsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { existsSync, mkdtempSync, readdirSync, rmSync } from 'node:fs';

High

Child Process

Package source references child process execution.

native/process-provider.mjsView on unpkg · L1

3import {

4 arch,

5 homedir,

6 hostname,

7 platform,

8 release as osRelease,

9 tmpdir,

10 type as osType,

11 version as osVersion,

12} from 'node:os';

13import { join, resolve } from 'node:path';

14import {

15 DEFAULT_PYTHON_TIMEOUT_MS,

16 DEFAULT_SHELL,

17 DEFAULT_TIMEOUT_MS,

18 HOST_FEATURES,

19 MAX_OUTPUT_BYTES,

20 MAX_PYTHON_CODE_BYTES,

21 MAX_PYTHON_OUTPUT_BYTES,

native/session-provider.mjsView file

Lines 1-38javascript

1import { spawn } from 'node:child_process';

2import { randomUUID } from 'node:crypto';

3import { homedir, platform } from 'node:os';

4import {

5 DEFAULT_SHELL,

6 DEFAULT_TIMEOUT_MS,

7 SESSION_IDLE_TIMEOUT_MS,

8 SESSION_MARKER_PREFIX,

lib/installer.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync } from 'node:child_process';

3import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/installer.mjsView on unpkg · L1

4import { platform } from 'node:os';

5import { dirname, resolve } from

Source & flagged code

4 flagged · loading source

native/process-provider.mjsView file

1import { spawn } from 'node:child_process'; L2: import { existsSync, mkdtempSync, readdirSync, rmSync } from 'node:fs';

High

Child Process

Package source references child process execution.

native/process-provider.mjsView on unpkg · L1

native/session-provider.mjsView file

18// Keep the shell reading commands from stdin so subsequent commands reuse the L19: // same process. `-NonInteractive` on Windows keeps PowerShell from printing L20: // prompts; `-Command -` makes it read a script from stdin. POSIX shells with

High

Shell

Package source references shell execution.

native/session-provider.mjsView on unpkg · L18

lib/installer.mjsView file

98Examples: L99: npx deepseek-pp-shell-host install --browser chrome --extension-id [redacted] L100: npx deepseek-pp-shell-host install --browser chrome --extension-id [redacted] --log-file "$HOME/dpp-host.log" ... L108: try { L109: execFileSync('reg', ['add', registryKey, '/ve', '/t', 'REG_SZ', '/d', manifestPath, '/f'], { stdio: 'pipe' }); L110: console.log(`Registry: ${registryKey}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/installer.mjsView on unpkg · L98

1#!/usr/bin/env node L2: import { execFileSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'; ... L129: if (!existsSync(manifestPath)) return null; L130: return JSON.parse(readFileSync(manifestPath, 'utf8')); L131: } ... L185: console.log(`OfficeCLI: ${officeCli ? `compatible (${officeCli})` : 'missing or incompatible'}`); L186: if (!isReady) process.exitCode = 1; L187: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/installer.mjsView on unpkg · L1

Findings

3 High4 Medium3 Low

HighChild Processnative/process-provider.mjs

HighShellnative/session-provider.mjs

HighRuntime Package Installlib/installer.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencelib/installer.mjs

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

native/process-provider.mjsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { existsSync, mkdtempSync, readdirSync, rmSync } from 'node:fs';

High

Child Process

Package source references child process execution.

native/process-provider.mjsView on unpkg · L1

3import {

4 arch,

5 homedir,

6 hostname,

7 platform,

8 release as osRelease,

9 tmpdir,

10 type as osType,

11 version as osVersion,

12} from 'node:os';

13import { join, resolve } from 'node:path';

14import {

15 DEFAULT_PYTHON_TIMEOUT_MS,

16 DEFAULT_SHELL,

17 DEFAULT_TIMEOUT_MS,

18 HOST_FEATURES,

19 MAX_OUTPUT_BYTES,

20 MAX_PYTHON_CODE_BYTES,

21 MAX_PYTHON_OUTPUT_BYTES,

native/session-provider.mjsView file

Lines 1-38javascript

1import { spawn } from 'node:child_process';

2import { randomUUID } from 'node:crypto';

3import { homedir, platform } from 'node:os';

4import {

5 DEFAULT_SHELL,

6 DEFAULT_TIMEOUT_MS,

7 SESSION_IDLE_TIMEOUT_MS,

8 SESSION_MARKER_PREFIX,

lib/installer.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync } from 'node:child_process';

3import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/installer.mjsView on unpkg · L1

4import { platform } from 'node:os';

5import { dirname, resolve } from

Lines 78-118javascript

78 console.log(`DeepSeek++ Shell Native Host installer

80Usage:

81 deepseek-pp-shell-host install --browser chrome --extension-id <extension-id>

82 deepseek-pp-shell-host status --browser chrome

83 deepseek-pp-shell-host uninstall --browser chrome

85Commands:

86 install Install the Shell Native Host and OfficeCLI

87 status Show manifest, host, and OfficeCLI status

88 uninstall Remove the Shell Native Host manifest and installed host files

90Options:

91 --extension-id <id> Chrome/Edge/Chromium extension ID

92 --browser <name> Target browser: chrome, chromium, edge, firefox (default: chrome)

93 --skip-officecli Install only the Shell Native Host

94 --force-officecli Reinstall OfficeCLI even if a compatible binary exists

95 --log-file <path> Write native host diagnostic logs to this file (for troubleshooting)

96 --help Show this help

98Examples:

99 npx deepseek-pp-shell-host install --browser chrome --extension-id abcdefghijklmnopqrstuvwxyz123456

100 npx deepseek-pp-shell-host install --browser chrome --extension-id abcdefghijklmnopqrstuvwxyz123456 --log-file "$HOME/dpp-host.log"

101 npx deepseek-pp-shell-host install --browser firefox

102`);

103}

104

105function writeWindowsRegistry(browser, manifestPath) {

106 const registryKey = getRegistryKey(browser);

107 if (!registryKey) return;

108 try {

109 execFileSync('reg', ['add', registryKey, '/ve', '/t', 'REG_SZ', '/d', manifestPath, '/f'], { stdio: 'pipe' });

110 console.log(`Registry: ${registryKey}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/installer.mjsView on unpkg · L98

111 } catch {

112 console.error('Warning: Failed to write registry key. You may need to run as Administrator.');

113 console.error(` Manual: reg add "${registryKey}" /ve /t REG_SZ /d "${manifestPath}" /f`);

114 }

115}

116

117function removeWindowsRegistry(browser) {

118 const registryKey = getRegistryKey(browser);