Loading npm security reports…
Git status badges for DeepSeek Harness: an input-row chip on every install, plus sidebar session-row badges (git status, PR/CI action tokens) after one manual step: `npx dsh-git-badge apply`, then restart dsh web. Event-driven freshness over SSE.
LPM flags this version as an AI-agent control-surface risk. Installation automatically alters a foreign DSH host package and adds a user-level agent skill. This creates an unconsented AI-agent control-surface change.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
seam/postinstall.jsView on unpkg · L23Package source invokes a package manager install command at runtime.
seam/postinstall.jsView on unpkg · L23This report applies to dsh-git-badge@0.14.1.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L17Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L17A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgPackage source references child process execution.
seam/postinstall.jsView on unpkg · L23Package source invokes a package manager install command at runtime.
seam/postinstall.jsView on unpkg · L23