dsh-enterprise
DSH enterprise client plugin: unified enterprise sign-in, model gateway provisioning and policy governance
This report shows the evidence for dsh-enterprise@0.9.20. 0 of 8 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential flows target the configured enterprise gateway and are tied to policy, model, and heartbeat functions. The new restart helper is wired to a host-restart endpoint; the inspected source does not show unrelated credential collection or harmful automatic behavior.
Decision evidence
public snapshot- The manifest exposes the plugin entry point and declares no install lifecycle scripts.
- Policy acknowledgments send the stored token to the saved enterprise gateway, gated on gateway and token being present.
- On startup, model reconciliation runs only when a gateway, logged-in user, and token are present; the request goes to that gateway.
- Heartbeat sends device information to the saved gateway as part of the enterprise management function.
- The added restart helper is connected to the plugin’s restart endpoint and relaunches the host application.
Source & flagged code
5 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/policy/policy.jsView on unpkgSource combines credential-like environment material and outbound requests; review data flow before blocking.
lib/policy/policy.jsView on unpkg · L29Findings
Affected versions and remediation
This report applies to dsh-enterprise@0.9.20.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of dsh-enterprise@0.9.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.