Loading npm security reports…

dsh-harmonyos@0.10.5: AI-agent control-surface risk | LPM Firewall

registry / dsh-harmonyos / 0.10.5

dsh-harmonyos@0.10.5

DeepSeek Harness for HarmonyOS — 一条命令装好:JS-only 替代/裁剪 profile、鸿蒙文件系统补丁、compat loader(zstd/fs-ext/sharp shim)、自启脚本(优先原生 zstd 的 node)。装完跑 dsh-ohos 即可。

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically rewrites foreign DSH agent dependencies. It forces an unrestricted sandbox default and weakens loopback web authentication.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

A consumer's DSH installation can run with danger-full-access and accept unauthenticated loopback sessions.

Mechanism

Automatic patching of a foreign AI-agent control surface.

Policy narrative

Installing the package invokes its patcher automatically. The patcher modifies DSH dependency code, including the sandbox policy so an environment flag selects danger-full-access, and modifies the loopback authentication flow to mint a session cookie for a tokenless request. This is unconsented postinstall modification of a foreign AI-agent control surface, not merely a user-invoked compatibility command.

AI rationale

The package has a concrete automatic install-time path that weakens a foreign agent's permission and authentication controls. No exfiltration was needed to establish this install-hook abuse.

Evidence

package.jsonlib/patch.mjsnode_modules/@deepseek-ai/dsh-sandbox-policy/lib/index.jsnode_modules/@deepseek-ai/dsh-client-connection/lib/index.js

Decision evidence

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./lib/patch.mjs patch && node ./lib/prune.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./lib/patch.mjs patch && node ./lib/prune.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/dsh-ohos.jsView file

10// NODE_OHOS=/path/node dsh-ohos # 指定 node L11: import { spawn, spawnSync, execFileSync } from 'node:child_process'; L12: import { existsSync, readFileSync, readdirSync, writeFileSync, renameSync, copyFileSync, mkdirSync, rmSync, appendFileSync, chmodSync, statSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/dsh-ohos.jsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.10.4 matchedPath = bin/dsh-ohos.js matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.10.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/dsh-ohos.jsView on unpkg

compat/zlib-shim.mjsView file

8L9: const require = createRequire(import.meta.url); L10: const zlib = require('node:zlib');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

compat/zlib-shim.mjsView on unpkg · L8

scripts/smoke.mjsView file

4// → 带 cookie GET / 期待 200 → 杀进程。全链路通过 exit 0, 否则 exit 1(打印日志尾部)。 L5: import { spawn } from 'node:child_process'; L6: import { createServer } from 'node:net'; L7: import { join, dirname } from 'node:path'; ... L12: L13: if (!process.env.NODE_OHOS) { L14: console.error('smoke: 未配置 NODE_OHOS(见 README 环境要求)');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/smoke.mjsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.10.4 matchedPath = scripts/smoke.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.10.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/smoke.mjsView on unpkg

prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.nodeView file

•path = prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.node kind = native_binary sizeBytes = 72128 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.nodeView on unpkg

scripts/switch-to-staging.shView file

•path = scripts/switch-to-staging.sh kind = build_helper sizeBytes = 4000 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/switch-to-staging.shView on unpkg

lib/patch.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.mjs#virtual:normalized:round1View on unpkg

scripts/sync-forks.mjsView file

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.10.4 matchedPath = scripts/sync-forks.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.10.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-forks.mjsView on unpkg

lib/anchors.mjsView file

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.10.4 matchedPath = lib/anchors.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.10.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/anchors.mjsView on unpkg

lib/patch.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-harmonyos@0.7.2 matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.7.2 similarity = 0.455 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/patch.mjsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 7-47json

7 "deepseek-harness",

8 "harmonyos",

9 "ohos",

10 "agent"

11 ],

12 "license": "MIT",

13 "type": "module",

14 "bin": {

15 "dsh-ohos": "./bin/dsh-ohos.js",

16 "dsh-harmonyos": "./bin/dsh-ohos.js"

17 },

18 "main": "lib/index.js",

19 "exports": {

20 ".": "./lib/index.js",

21 "./compat-loader": "./compat/compat-loader.mjs"

22 },

23 "engines": {

24 "node": ">=22.16.0"

25 },

26 "scripts": {

27 "postinstall": "node ./lib/patch.mjs patch && node ./lib/prune.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "patch": "node ./lib/patch.mjs patch",

29 "check": "node ./lib/patch.mjs check",

30 "preflight": "node ./lib/anchors.mjs",

31 "prune": "node ./lib/prune.mjs",

32 "sync-forks": "node ./scripts/sync-forks.mjs",

33 "cutover": "node ./scripts/cutover-overrides.mjs",

34 "test": "node ./scripts/smoke.mjs"

35 },

36 "dependencies": {

37 "@deepseek-ai/dsh": "0.1.5-rc.2",

38 "@deepseek-ai/dsh-host-directory-picker-auto": "^0.1.5-rc.2",

39 "zstd-codec": "^0.1.5",

40 "@img/sharp-wasm32": "0.35.4",

41 "@deepseek-ai/dsh-session-persistence-jsonl": "npm:@dsh-harmonyos/dsh-session-persistence-jsonl@0.1.5-rc.2-harmony.1",

42 "@deepseek-ai/dsh-attachment-local": "npm:@dsh-harmonyos/dsh-attachment-local@0.1.5-rc.2-harmony.1",

43 "@deepseek-ai/dsh-fs-local": "npm:@dsh-harmonyos/dsh-fs-local@0.1.5-rc.2-harmony.1",

44 "@deepseek-ai/node-addon-system": "npm:@dsh-harmonyos/node-addon-system@0.1.2-harmony.1",

45 "@deepseek-ai/dsh-client-resources": "npm:@dsh-harmonyos/dsh-client-resources@0.1.5-rc.2-harmony.1",

46 "@deepseek-ai/dsh-tool-fs-search": "npm:@dsh-harmonyos/dsh-tool-fs-search@0.1.5-rc.2-harmony.1",

47 "@deepseek-ai/dsh-credentials-local": "npm:@dsh-harmonyos/dsh-credentials-local@0.1.5-rc.2-harmony.1",

bin/dsh-ohos.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// dsh-ohos: DeepSeek Harness for HarmonyOS 启动器

3// - 定位本包 node_modules 里的官方 dsh

4// - 自动挑可用 node: 优先「带原生 zstd 的」(node>=22.16, 免 wasm 兼容层)

5// - 固定必要参数: --expose-internals --experimental-sqlite --experimental-loader compat

6// - 挂载 dsh-harmonyos overlay(原生行替换/禁用)

7// 用法:

8// dsh-ohos # 启动 web(127.0.0.1:3080, 作者默认)

9// dsh-ohos -- <官方dsh参数> # 透传(如 --profile headless "任务"、--port 3081)

10// NODE_OHOS=/path/node dsh-ohos # 指定 node

compat/zlib-shim.mjsView file

Lines 1-28javascript

1// node:zlib 兼容层: node 22.7 缺原生 zstd(22.16+) 的 createZstdCompress/createZstdDecompress。

2// 优先用「原生」zstd(node>=22.16): 它与写入端一致, 能正确解开原生 zstd 帧(否则会报

3// "corrupt Zstandard session log")。仅当原生缺失(如 node22)时才回退到 zstd-codec(wasm)。

4// 其余导出原样透传。

5export * from 'node:zlib';

6import { Transform } from 'node:stream';

7

scripts/smoke.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// dsh-harmonyos 端到端冒烟测试 (npm test)

3// 流程: 起 dsh-ohos(随机空闲端口) → 等「dsh web: <token-url>」→ GET token URL 期待 303+set-cookie

4// → 带 cookie GET / 期待 200 → 杀进程。全链路通过 exit 0, 否则 exit 1(打印日志尾部)。

5import { spawn } from 'node:child_process';

6import { createServer } from 'node:net';

7import { join, dirname }

prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.nodeView file

•path = prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.node kind = native_binary sizeBytes = 72128 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.nodeView on unpkg

scripts/switch-to-staging.shView file

•path = scripts/switch-to-staging.sh kind = build_helper sizeBytes = 4000 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/switch-to-staging.shView on unpkg

lib/patch.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.mjs#virtual:normalized:round1View on unpkg

scripts/sync-forks.mjsView file

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.10.4 matchedPath = scripts/sync-forks.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.10.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-forks.mjsView on unpkg

lib/anchors.mjsView file

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.10.4 matchedPath = lib/anchors.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.10.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/anchors.mjsView on unpkg

lib/patch.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-harmonyos@0.7.2 matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.7.2 similarity = 0.455 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/patch.mjsView on unpkg