registry / dsh-agy-link / 0.4.99
dsh-agy-link@0.4.99
Google Antigravity (agy CLI) models for DeepSeek Harness — stream Gemini/Claude/GPT-OSS subscriptions into DSH with thinking, tool activity, token usage and in-GUI Google OAuth login.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package's inspected credential flow uses Google OAuth and Google API endpoints, and the MCP bridge is disabled by default and protected on loopback. The prepare hook only runs the build, and the version changelog describes a tool-view update.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
OAuth and CLI activity occur through the plugin's normal authentication and model-use flows. The MCP bridge starts only when explicitly enabled in configuration.
Impact
No unrelated credential collection, external credential redirection, or unrequested account action was identified. The optional bridge can expose configured DSH tools to the local Antigravity process.
Mechanism
The inspected OAuth flow targets Google endpoints. The optional MCP bridge uses a random bearer token and binds to loopback.
AI rationale
The package's inspected credential flow uses Google OAuth and Google API endpoints, and the MCP bridge is disabled by default and protected on loopback. The prepare hook only runs the build, and the version changelog describes a tool-view update.
Evidence
.mcp.json
Network endpoints8
accounts.google.comoauth2.googleapis.comwww.googleapis.comdaily-cloudcode-pa.googleapis.comdaily-cloudcode-pa.sandbox.googleapis.comcloudcode-pa.googleapis.com127.0.0.1antigravity.google
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a DSH plugin entry and a separate client export.
- The prepare and prepack lifecycle scripts run the package build.
- The OAuth authorization and token URLs use Google hosts, with a localhost callback.
- The MCP bridge is disabled in the default configuration.
- The bridge requires a random bearer token and listens on 127.0.0.1.
- The bridge starts only when both mcpBridge and the plugin enabled setting are true.
Evidence against
- The package uses child processes to run the Antigravity CLI as part of its stated purpose.
- When enabled, the MCP bridge can expose configured DSH tools to the local Antigravity process.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
10 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = dsh-agy-link@0.4.96
matchedIdentity = npm:ZHNoLWFneS1saW5r:0.4.96
similarity = 0.909
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1import { createRequire } from "node:module";
L2: import { execFile, execFileSync, spawn } from "node:child_process";
L3: import path, { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { accessSync, chmodSync, constants, copyFileSync, createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync,...
import { mkdir, mkdtemp, readFile, readdir, rm, stat, unlink, writeFile } from "node:fs/promises";
* a HEALTHY account and DSH renders the AUTH code as "API key is invalid"
function rewriteImageMarkdown(text, mediaBaseUrl) {
if (!mediaBaseUrl || !text) return text;
return `}`})`;
const processedText = this.opts.mediaBaseUrl ? rewriteImageMarkdown(ev.text, this.opts.mediaBase
Findings
1 Critical9 High3 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighSemantic Analysis Limitedassets/icon.svg
HighKnown Malware Source Similarityassets/mermaid.min.js
HighKnown Malware Source Similaritydist/assets/mermaid.min.js
HighKnown Malware Source Similaritydist/mermaid.min.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to dsh-agy-link@0.4.99.
See all versions of dsh-agy-link for other recorded verdicts.
- Review the evidence and your use of dsh-agy-link@0.4.99 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.