Loading npm security reports…
Git status badges for DeepSeek Harness: an input-row chip on every install, plus sidebar session-row badges (git status, PR/CI action tokens) after one manual step: `npx dsh-git-badge apply`, then restart dsh web. Event-driven freshness over SSE.
LPM flags this version as an AI-agent control-surface risk. Installing the package automatically patches a separate DSH installation. It replaces host UI code and its host entrypoint, while retaining backups in a user-level DSH directory.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe package automatically runs a postinstall hook.
package.jsonView on unpkg · L15Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/index.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
seam/apply.jsView on unpkgThis report applies to dsh-git-badge@0.10.1.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L17Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L17The package automatically runs a postinstall hook.
package.jsonView on unpkg · L15A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/index.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
seam/apply.jsView on unpkg