registry / dsh-agy-link / 0.4.92
dsh-agy-link@0.4.92
Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe reviewed credential flows target Google OAuth and Antigravity services, consistent with the package's stated purpose. The flagged bridge and warmup features are disabled by default, and the lifecycle scripts only build the package.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The plugin runs when activated by DSH; OAuth and model requests occur as part of its configured features.
Impact
No unsolicited credential or project-data exfiltration or other malicious behavior was identified.
Mechanism
It sends Google OAuth and Antigravity API requests. The MCP bridge and scheduled warmup require explicit configuration and are disabled by default.
AI rationale
The reviewed credential flows target Google OAuth and Antigravity services, consistent with the package's stated purpose. The flagged bridge and warmup features are disabled by default, and the lifecycle scripts only build the package.
Network endpoints4
oauth2.googleapis.comwww.googleapis.comdaily-cloudcode-pa.googleapis.comcloudcode-pa.googleapis.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points the package entry point to dist/index.js, matching its role as a DSH plugin.
- The prepare and prepack scripts only run the build command.
- The OAuth token and user-info requests use Google endpoints and a localhost callback.
- The Antigravity API fallback endpoints are Google Cloud Code hosts.
- The MCP bridge is disabled by default and starts only when enabled in configuration.
- Scheduled model warmup is disabled by default and checks the autoWarmup setting before running.
Evidence against
- The entry point uses child_process and filesystem APIs to integrate with the agy CLI and manage local state.
- The plugin handles Google bearer tokens and makes authenticated API requests.
- The plugin can start an MCP bridge and write configuration when that feature is enabled.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
7 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = dsh-agy-link@0.4.70
matchedIdentity = npm:ZHNoLWFneS1saW5r:0.4.70
similarity = 0.727
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1import { createRequire } from "node:module";
L2: import { execFile, execFileSync, spawn } from "node:child_process";
L3: import path, { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { accessSync, chmodSync, constants, copyFileSync, createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, utimesSync, w...
import { mkdir, mkdtemp, readFile, readdir, rm, stat, unlink, writeFile } from "node:fs/promises";
* a HEALTHY account and DSH renders the AUTH code as "API key is invalid"
function rewriteImageMarkdown(text, mediaBaseUrl) {
if (!mediaBaseUrl || !text) return text;
return `}`})`;
const processedText = this.opts.mediaBaseUrl ? rewriteImageMarkdown(ev.text, this.opts.mediaBase
Findings
1 Critical6 High3 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighSemantic Analysis Limitedassets/icon.svg
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
Low
Affected versions and remediation
This report applies to dsh-agy-link@0.4.92.
See all versions of dsh-agy-link for other recorded verdicts.
- Review the evidence and your use of dsh-agy-link@0.4.92 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.