Loading npm security reports…

dsh-harmonyos: Clean npm security report (Allow) | LPM Firewall

registry / dsh-harmonyos / 0.13.2

dsh-harmonyos@0.13.2

DeepSeek Harness for HarmonyOS — 一条命令装好:JS-only 替代/裁剪 profile、鸿蒙文件系统补丁、compat loader(zstd/fs-ext/sharp shim)、内置预设 bundle、自启脚本(优先原生 zstd 的 node)。装完跑 dsh-ohos 即可。

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No attack surface was identified in the inspected package source. The package patches its own dsh dependency tree and launches the configured dsh runtime for HarmonyOS compatibility.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installation runs the local compatibility patch and prune scripts; explicit launcher invocation starts dsh.

Impact

No confirmed credential exfiltration, remote payload execution, persistence outside package-aligned dsh configuration, or destructive attack behavior was established.

Mechanism

The inspected code changes local dependency files, configures launcher environment variables, and tests only a loopback web endpoint.

AI rationale

The install hook and launcher behavior are package-aligned HarmonyOS adaptation work, not a concrete attack chain. Static inspection found no malicious network sink, secret collection, self-dependency lifecycle chain, or covert execution path.

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package has one postinstall hook that runs its local patch and prune scripts.
The launcher configures HarmonyOS compatibility environment defaults for the child application.

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./lib/patch.mjs patch && node ./lib/prune.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./lib/patch.mjs patch && node ./lib/prune.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/dsh-ohos.jsView file

10// NODE_OHOS=/path/node dsh-ohos # 指定 node L11: import { spawn, spawnSync, execFileSync } from 'node:child_process'; L12: import { existsSync, readFileSync, readdirSync, writeFileSync, renameSync, copyFileSync, mkdirSync, rmSync, appendFileSync, chmodSync, statSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/dsh-ohos.jsView on unpkg · L10

scripts/smoke.mjsView file

4// → 带 cookie GET / 期待 200 → 杀进程。全链路通过 exit 0, 否则 exit 1(打印日志尾部)。 L5: import { spawn } from 'node:child_process'; L6: import { createServer } from 'node:net'; L7: import { join, dirname } from 'node:path'; ... L12: L13: if (!process.env.NODE_OHOS) { L14: console.error('smoke: 未配置 NODE_OHOS(见 README 环境要求)');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/smoke.mjsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.9.0 matchedPath = scripts/smoke.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/smoke.mjsView on unpkg

prebuilt/koffi-3.3.1-linux-arm64-musl.nodeView file

•path = prebuilt/koffi-3.3.1-linux-arm64-musl.node kind = native_binary sizeBytes = 1189440 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/koffi-3.3.1-linux-arm64-musl.nodeView on unpkg

scripts/switch-to-staging.shView file

•path = scripts/switch-to-staging.sh kind = build_helper sizeBytes = 4000 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/switch-to-staging.shView on unpkg

lib/patch.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.mjs#virtual:normalized:round1View on unpkg

scripts/sync-forks.mjsView file

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.10.5 matchedPath = scripts/sync-forks.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.10.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-forks.mjsView on unpkg

lib/patch.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-harmonyos@0.12.0 matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.12.0 similarity = 0.765 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/patch.mjsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 7-47json

7 "deepseek-harness",

8 "harmonyos",

9 "ohos",

10 "agent"

11 ],

12 "license": "MIT",

13 "type": "module",

14 "bin": {

15 "dsh-ohos": "./bin/dsh-ohos.js",

16 "dsh-harmonyos": "./bin/dsh-ohos.js"

17 },

18 "main": "lib/index.js",

19 "exports": {

20 ".": "./lib/index.js",

21 "./compat-loader": "./compat/compat-loader.mjs"

22 },

23 "engines": {

24 "node": ">=22.16.0"

25 },

26 "scripts": {

27 "postinstall": "node ./lib/patch.mjs patch && node ./lib/prune.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "patch": "node ./lib/patch.mjs patch",

29 "check": "node ./lib/patch.mjs check",

30 "preflight": "node ./lib/anchors.mjs",

31 "prune": "node ./lib/prune.mjs",

32 "sync-forks": "node ./scripts/sync-forks.mjs",

33 "cutover": "node ./scripts/cutover-overrides.mjs",

34 "test": "node ./scripts/smoke.mjs",

35 "preset-check": "node ./scripts/preset-check.mjs"

36 },

37 "dependencies": {

38 "@deepseek-ai/dsh": "0.1.7-rc.2",

39 "@dsh-harmonyos/preset-harmonyos-chat": "0.13.2",

40 "@deepseek-ai/dsh-host-directory-picker-auto": "0.1.7-rc.2",

41 "koffi": "3.3.1",

42 "zstd-codec": "^0.1.5",

43 "@img/sharp-wasm32": "0.35.4",

44 "@deepseek-ai/dsh-session-persistence-jsonl": "npm:@dsh-harmonyos/dsh-session-persistence-jsonl@0.1.7-rc.2-harmony.1",

45 "@deepseek-ai/dsh-attachment-local": "npm:@dsh-harmonyos/dsh-attachment-local@0.1.7-rc.2-harmony.1",

46 "@deepseek-ai/node-addon-system": "npm:@dsh-harmonyos/node-addon-system@0.1.2-harmony.1",

47 "@deepseek-ai/dsh-client-resources": "npm:@dsh-harmonyos/dsh-client-resources@0.1.7-rc.2-harmony.1",

bin/dsh-ohos.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// dsh-ohos: DeepSeek Harness for HarmonyOS 启动器

3// - 定位本包 node_modules 里的官方 dsh

4// - 自动挑可用 node: 优先「带原生 zstd 的」(node>=22.16, 免 wasm 兼容层)

5// - 固定必要参数: --expose-internals --experimental-sqlite --experimental-loader compat

6// - 挂载 dsh-harmonyos overlay(原生行替换/禁用)

7// 用法:

8// dsh-ohos # 启动 web(127.0.0.1:3080, 作者默认)

9// dsh-ohos -- <官方dsh参数> # 透传(如 --profile headless "任务"、--port 3081)

10// NODE_OHOS=/path/node dsh-ohos # 指定 node

scripts/smoke.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// dsh-harmonyos 端到端冒烟测试 (npm test)

3// 流程: 起 dsh-ohos(随机空闲端口) → 等「dsh web: <token-url>」→ GET token URL 期待 303+set-cookie

4// → 带 cookie GET / 期待 200 → 杀进程。全链路通过 exit 0, 否则 exit 1(打印日志尾部)。

5import { spawn } from 'node:child_process';

6import { createServer } from 'node:net';

7import { join, dirname }

prebuilt/koffi-3.3.1-linux-arm64-musl.nodeView file

•path = prebuilt/koffi-3.3.1-linux-arm64-musl.node kind = native_binary sizeBytes = 1189440 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/koffi-3.3.1-linux-arm64-musl.nodeView on unpkg

scripts/switch-to-staging.shView file

•path = scripts/switch-to-staging.sh kind = build_helper sizeBytes = 4000 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/switch-to-staging.shView on unpkg

lib/patch.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.mjs#virtual:normalized:round1View on unpkg

scripts/sync-forks.mjsView file

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.10.5 matchedPath = scripts/sync-forks.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.10.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-forks.mjsView on unpkg

lib/patch.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-harmonyos@0.12.0 matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.12.0 similarity = 0.765 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/patch.mjsView on unpkg