registry / dsh-enterprise / 0.9.13
dsh-enterprise@0.9.13
DSH enterprise client plugin: unified enterprise sign-in, model gateway provisioning and policy governance
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
2 flaggedlib/policy/policy.jsView file
27try {
L28: const r = await fetch(`${base}/policy/current`, { signal: AbortSignal.timeout(4000) })
L29: const b = await r.json().catch(() => null)
L30: policyCache.policy = b ?? policyCache.policy
...
L49: headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
L50: body: JSON.stringify({ profile: process.env.DSH_PROFILE ?? 'dsh', policyVersion: ver, device: 'enterprise' }),
L51: signal: AbortSignal.timeout(4000),
...
L94:
L95: /** 读取 profile 根目录（插件自身位置向上找含 dsh.profile.bundles 的 package.json） */
L96: export function findProfileRoot() {
...
L135: const shimCandidates = [
L136: join(homedir(), '.local', 'bin', 'dsh'), // mac-setup.sh 写的 zsh shim
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
lib/policy/policy.jsView on unpkg · L2727Trigger-reachable credential exfiltration chain: manifest.main -> lib/index.js -> lib/enforce/plugin-enforce.js -> lib/policy/policy.js
L27: try {
L28: const r = await fetch(`${base}/policy/current`, { signal: AbortSignal.timeout(4000) })
L29: const b = await r.json().catch(() => null)
L30: policyCache.policy = b ?? policyCache.policy
...
L49: headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
L50: body: JSON.stringify({ profile: process.env.DSH_PROFILE ?? 'dsh', policyVersion: ver, device: 'enterprise' }),
L51: signal: AbortSignal.timeout(4000),
...
L94:
L95: /** 读取 profile 根目录（插件自身位置向上找含 dsh.profile.bundles 的 package.json） */
L96: export function findProfileRoot() {
...
L135: const shimCandidates = [
L136: join(homedir(), '.local', 'bin', 'dsh'),
Findings
2 High2 Medium4 Low
HighCredential Exfiltrationlib/policy/policy.js
HighTrigger Reachable Credential Exfiltrationlib/policy/policy.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dsh-enterprise@0.9.13.
See all versions of dsh-enterprise for other recorded verdicts.
- Review the evidence and your use of dsh-enterprise@0.9.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.