registry / Malware / dsh-agy-link

dsh-agy-link

Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.

This report shows the evidence for dsh-agy-link@0.4.98. 4 of 72 known versions are blocked or flagged. The newest version, 0.5.2, is allowed. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package embeds an explicit instruction in model-facing runtime output to avoid investigating its bridge and logs. That is reviewer manipulation; the local, bearer-protected bridge and build-only prepare script do not negate it.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A mirrored tool step executes but its recorded output is unavailable.

Impact

This can steer a model away from examining the bridge and encourage repeated tool execution, interfering with independent review.

Mechanism

The package returns a diagnostic message that says not to investigate the bridge or message and prompts the model to continue or rerun the operation.

Attack narrative

When a mirrored tool result is unavailable, the package returns a message instructing the model not to investigate the bridge or its logs and to continue the task or rerun the operation. This is model-directed suppression embedded in runtime output and qualifies as reviewer manipulation.

AI rationale

Evidence

dist/index.js

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The runtime constructs a tool-result message telling the model not to investigate the bridge or its logs, then directs it to continue or rerun the operation.
This instruction is emitted as a response for an executed tool step, so it can steer the model receiving package-generated output.

Evidence against

The package describes itself as a DeepSeek Harness integration for Antigravity models and tool activity.
Its MCP bridge binds to 127.0.0.1 and requires a generated bearer token.
The prepare and prepack scripts build the package; no install-time data collection was identified.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 11.8 MB of source, external domains: 127.0.0.1, accounts.google.com, antigravity.google, chevrotain.io, cloudcode-pa.googleapis.com, daily-cloudcode-pa.googleapis.com, daily-cloudcode-pa.sandbox.googleapis.com, en.wikipedia.org, github.com, langium.org, oauth2.googleapis.com, www.googleapis.com, www.w3.org

Source & flagged code

7 flagged

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-agy-link@0.4.70 matchedIdentity = npm:ZHNoLWFneS1saW5r:0.4.70 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { accessSync, chmodSync, constants, copyFileSync, createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync,... import { mkdir, mkdtemp, readFile, readdir, rm, stat, unlink, writeFile } from "node:fs/promises"; * a HEALTHY account and DSH renders the AUTH code as "API key is invalid" function rewriteImageMarkdown(text, mediaBaseUrl) { if (!mediaBaseUrl || !text) return text; return `![${alt}](${`${mediaBaseUrl}?path=${encodeURIComponent(cleanTarget)}`})`; const processedText = this.opts.mediaBaseUrl ? rewriteImageMarkdown(ev.text, this.opts.mediaBase

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

1import { createRequire } from "node:module"; L2: import { execFile, execFileSync, spawn } from "node:child_process"; L3: import path, { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path"; ... L11: import { EventEmitter } from "node:events"; L12: import { createServer } from "node:http"; L13: import { promisify } from "node:util"; ... L145: proxyUrl: "", L146: suppressAgyAutoUpdate: process.platform === "win32", L147: autoWarmup: false, ... L232: * L233: * The stderr banner agy prints when silent auth fails is byte-identical for a L234: * genuine sign-out and for a keyring validation that missed its hard 10s

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1import { createRequire } from "node:module"; L2: import { execFile, execFileSync, spawn } from "node:child_process"; L3: import path, { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path"; ... L435: if (!existsSync(file)) return {}; L436: const v = JSON.parse(readFileSync(file, "utf8")); L437: return v && typeof v === "object" ? v : {}; ... L1773: /** Rewrite local image paths and file:// URLs to point to the local media route. */ L1774: function rewriteImageMarkdown(text, mediaBaseUrl) { L1775: if (!mediaBaseUrl || !text) return text;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L1

1Cross-file remote execution chain: dist/index.js spawns assets/mermaid.min.js; helper contains network access plus dynamic code execution. L1: import { createRequire } from "node:module"; L2: import { execFile, execFileSync, spawn } from "node:child_process"; L3: import path, { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path"; ... L11: import { EventEmitter } from "node:events"; L12: import { createServer } from "node:http"; L13: import { promisify } from "node:util"; ... L145: proxyUrl: "", L146: suppressAgyAutoUpdate: process.platform === "win32", L147: autoWarmup: false, ... L232: * L233: * The stderr banner agy prints when silent auth fails is byte-identical for a L234: * genuine sign-out and for a keyring validation that missed its har

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

assets/icon.svgView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/icon.svgView on unpkg

Findings

1 Critical6 High3 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/index.js

HighRemote Agent Bridgedist/index.js

HighCross File Remote Execution Contextdist/index.js

HighSemantic Analysis Limitedassets/icon.svg

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to dsh-agy-link@0.4.98.

The versions list below shows the verdict for each recorded version.

Avoid installing dsh-agy-link@0.4.98. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-30 21:32:30.270Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

72 known versions

registry / Malware / dsh-agy-link

dsh-agy-link

Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.

This report shows the evidence for dsh-agy-link@0.4.98. 4 of 72 known versions are blocked or flagged. The newest version, 0.5.2, is allowed. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A mirrored tool step executes but its recorded output is unavailable.

Impact

This can steer a model away from examining the bridge and encourage repeated tool execution, interfering with independent review.

Mechanism

The package returns a diagnostic message that says not to investigate the bridge or message and prompts the model to continue or rerun the operation.

Attack narrative

AI rationale

Evidence

dist/index.js

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The runtime constructs a tool-result message telling the model not to investigate the bridge or its logs, then directs it to continue or rerun the operation.
This instruction is emitted as a response for an executed tool step, so it can steer the model receiving package-generated output.

Evidence against

The package describes itself as a DeepSeek Harness integration for Antigravity models and tool activity.
Its MCP bridge binds to 127.0.0.1 and requires a generated bearer token.
The prepare and prepack scripts build the package; no install-time data collection was identified.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1import { createRequire } from "node:module"; L2: import { execFile, execFileSync, spawn } from "node:child_process"; L3: import path, { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path"; ... L435: if (!existsSync(file)) return {}; L436: const v = JSON.parse(readFileSync(file, "utf8")); L437: return v && typeof v === "object" ? v : {}; ... L1773: /** Rewrite local image paths and file:// URLs to point to the local media route. */ L1774: function rewriteImageMarkdown(text, mediaBaseUrl) { L1775: if (!mediaBaseUrl || !text) return text;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

assets/icon.svgView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/icon.svgView on unpkg

Findings

1 Critical6 High3 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/index.js

HighRemote Agent Bridgedist/index.js

HighCross File Remote Execution Contextdist/index.js

HighSemantic Analysis Limitedassets/icon.svg

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to dsh-agy-link@0.4.98.

The versions list below shows the verdict for each recorded version.

Avoid installing dsh-agy-link@0.4.98. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-30 21:32:30.270Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

72 known versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages