registry / dsh-agy-link / 0.4.21
dsh-agy-link@0.4.21
Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
1import { createRequire } from "node:module";
L2: import { execFile, execFileSync, spawn } from "node:child_process";
L3: import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
High
1757}
L1758: /** cmd.exe argument quoting (cross-spawn rules). Exported for tests. */
L1759: function windowsQuote(arg) {
High
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/index.js:
import { accessSync, chmodSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
import { mkdir, mkdtemp, readFile, readdir, rm, stat, unlink, writeFile } from "node:fs/promises";
await writeFile(path, data);
if (!bin) throw new LlmError("agy binary not found on PATH — install it via https://antigravity.google/docs/cli/install", Err.AGY_NOT_INSTALLED);
await writeFile(file, text, "utf8");
//#region node_modules/undici/lib/core/symbols.js
//#region node_modules/undici/lib/util/timers.js
* The state of the timer, which can be one of the following:
Findings
4 High3 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighEntrypoint Foreign Package Code Overwritedist/index.js
HighRemote Agent Bridgedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dsh-agy-link@0.4.21.
See all versions of dsh-agy-link for other recorded verdicts.
- Review the evidence and your use of dsh-agy-link@0.4.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.