Loading npm security reports…

dsh-harmonyos@0.1.0: AI-agent control-surface risk | LPM Firewall

registry / dsh-harmonyos / 0.1.0

dsh-harmonyos@0.1.0

DeepSeek Harness for HarmonyOS — 一条命令装好:JS-only 替代/裁剪 profile、鸿蒙文件系统补丁、node22 compat loader、自启脚本。装完跑 dsh-ohos 即可。

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies a neighboring DeepSeek DSH agent installation and removes its packages. The modifications disable a credential integrity check and weaken local web authentication.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation runs the postinstall hook.

Impact

A consumer's DSH agent controls and installed modules are changed without an explicit setup command; local access and credential protections are weakened.

Mechanism

Automatic foreign agent-module patching, authentication bypass, and recursive package deletion.

Policy narrative

During npm postinstall, the package locates an installed DeepSeek DSH dependency tree and rewrites several of its modules. It replaces the credential-module behavior with an early return, patches the web authentication flow to mint a long-lived cookie for unauthenticated loopback requests, alters permission handling, and recursively deletes installed DSH components. These are unconsented mutations of a foreign AI-agent control surface performed automatically at installation.

AI rationale

This is concrete postinstall modification of a foreign AI-agent installation, including credential-check and authentication weakening, followed by destructive dependency pruning. The behavior meets the install-control-surface block policy regardless of the stated HarmonyOS purpose.

Evidence

package.jsonlib/patch.mjslib/prune.mjsnode_modules/@deepseek-ai/dsh-credentials-local/lib/index.jsnode_modules/@deepseek-ai/dsh-client-connection/lib/index.jsnode_modules/@deepseek-ai/dsh-permission-presets/lib/index.js

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./lib/patch.mjs patch && node ./lib/prune.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2scripts.postinstall = node ./lib/patch.mjs patch && node ./lib/prune.mjs Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L2: // dsh 核心「检查更新」：check / patch / install / rollback。鸿蒙本机专用，零依赖。 L3: import { spawnSync } from 'node:child_process'; L4: import { readFileSync, writeFileSync, unlinkSync, appendFileSync, existsSync, mkdirSync, rmSync } from 'node:fs'; L5: import { homedir } from 'node:os'; ... L40: // 工作区新文件写入(create-if-absent)走硬链接发布，鸿蒙 /storage 挂载对 link() 报 EPERM， L41: // 即使目标不存在也失败；补丁在确认目标缺失后改按 rename 发布，保住 create-if-absent 语义。 L42: // 官方 alpha.2/alpha.3 均未含此兜底，升级重装会被冲掉，故必须纳入 patchAll 幂等重打。 ... L53: // dsh web 认证：0.1.2-alpha.2 每次进程启动都换新 launch token，本机新标签页/收藏夹的裸地址 L54: // http://127

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

•scripts.postinstall = node ./lib/patch.mjs patch && node ./lib/prune.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/patch.mjsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. lib/patch.mjs: import { readFileSync, writeFileSync, unlinkSync, appendFileSync, existsSync, mkdirSync, rmSync } from 'node:fs'; // 且 D/node_modules/@deepseek-ai/<pkg> 或 D/@deepseek-ai/<pkg> 存在 → 返回 D 或其 node_modules 父。 // 布局 A(flat): <dir>/node_modules/@deepseek-ai/<pkg> if (existsSync(join(dir, 'node_modules', '@deepseek-ai', 'dsh-credentials-local', 'package.json'))) return dir; // 布局 B(nested): <dir>/@deepseek-ai/dsh/node_modules/@deepseek-ai/<pkg> if (existsSync(join(dir, '@deepseek-ai', 'dsh', 'node_modules', '@deepseek-ai', 'dsh-credentials-local', 'package.json'))) { return join(dir, '@deepseek-ai', 'dsh'); // 其 node_modules 内是 sibling 树 // 布

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

lib/patch.mjsView on unpkg

lib/core-patch.src.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/core-patch.src.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "dsh-harmonyos",

3 "version": "0.1.0",

4 "description": "DeepSeek Harness for HarmonyOS — 一条命令装好:JS-only 替代/裁剪 profile、鸿蒙文件系统补丁、node22 compat loader、自启脚本。装完跑 dsh-ohos 即可。",

5 "keywords": [

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

6 "dsh",

7 "deepseek-harness",

8 "harmonyos",

9 "ohos",

10 "agent"

11 ],

12 "license": "MIT",

13 "type": "module",

14 "bin": {

15 "dsh-ohos": "./bin/dsh-ohos.js",

16 "dsh-harmonyos": "./bin/dsh-ohos.js"

17 },

18 "main": "lib/index.js",

19 "exports": {

20 ".": "./lib/index.js",

21 "./compat-loader": "./compat/compat-loader.mjs"

22 },

23 "engines": {

24 "node": ">=22.0.0"

25 },

26 "scripts": {

27 "postinstall": "node ./lib/patch.mjs patch && node ./lib/prune.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 },

29 "dependencies": {

30 "@deepseek-ai/dsh": "0.1.2-rc.1",

31 "zstd-codec": "^0.1.5"

32 }

33}

34

lib/patch.mjsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. lib/patch.mjs: import { readFileSync, writeFileSync, unlinkSync, appendFileSync, existsSync, mkdirSync, rmSync } from 'node:fs'; // 且 D/node_modules/@deepseek-ai/<pkg> 或 D/@deepseek-ai/<pkg> 存在 → 返回 D 或其 node_modules 父。 // 布局 A(flat): <dir>/node_modules/@deepseek-ai/<pkg> if (existsSync(join(dir, 'node_modules', '@deepseek-ai', 'dsh-credentials-local', 'package.json'))) return dir; // 布局 B(nested): <dir>/@deepseek-ai/dsh/node_modules/@deepseek-ai/<pkg> if (existsSync(join(dir, '@deepseek-ai', 'dsh', 'node_modules', '@deepseek-ai', 'dsh-credentials-local', 'package.json'))) { return join(dir, '@deepseek-ai', 'dsh'); // 其 node_modules 内是 sibling 树 // 布

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

lib/patch.mjsView on unpkg

lib/core-patch.src.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/core-patch.src.mjs#virtual:normalized:round1View on unpkg