Loading npm security reports…

dsh-harmonyos@0.7.0: Malicious npm security report (Block) | LPM Firewall

registry / dsh-harmonyos / 0.7.0

dsh-harmonyos@0.7.0

DeepSeek Harness for HarmonyOS — 一条命令装好:JS-only 替代/裁剪 profile、鸿蒙文件系统补丁、compat loader(zstd/fs-ext/sharp shim)、自启脚本(优先原生 zstd 的 node)。装完跑 dsh-ohos 即可。

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installation automatically modifies third-party DSH code, including credential and web authentication behavior. Running the launcher also weakens the DSH agent permission default.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall; invoking dsh-ohos activates the launcher changes.

Impact

Installed DSH instances can have weakened credential checks and loopback authentication; the launcher can persist unrestricted agent permissions.

Mechanism

Automatic patching of DSH security controls and forced dangerous agent settings.

Attack narrative

The package runs its patcher automatically at installation. That patcher alters installed DSH dependencies, bypasses a credential owner-security check, and adds loopback session minting behavior. Separately, its launcher writes danger-full-access into the user's DSH settings when no permission section exists and forces the matching environment flag. These unconsented changes affect a foreign AI-agent control surface rather than only this package's own files.

AI rationale

This is an install-time modification of a third-party AI-agent runtime that weakens security controls, followed by launcher-driven persistence of unrestricted permissions. The behavior meets the policy for malicious install-hook abuse.

Evidence

package.jsonlib/patch.mjsbin/dsh-ohos.jsnode_modules/@deepseek-ai/dsh-sandbox-policy/lib/index.jsnode_modules/@deepseek-ai/dsh-client-connection/lib/index.js$HOME/.dsh/settings.yaml

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./lib/patch.mjs patch && node ./lib/prune.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./lib/patch.mjs patch && node ./lib/prune.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/dsh-ohos.jsView file

10// NODE_OHOS=/path/node dsh-ohos # 指定 node L11: import { spawn, spawnSync, execFileSync } from 'node:child_process'; L12: import { existsSync, readFileSync, readdirSync, writeFileSync, renameSync, copyFileSync, mkdirSync, rmSync, appendFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/dsh-ohos.jsView on unpkg · L10

10Trigger-reachable persistence chain: manifest.bin -> bin/dsh-ohos.js L10: // NODE_OHOS=/path/node dsh-ohos # 指定 node L11: import { spawn, spawnSync, execFileSync } from 'node:child_process'; L12: import { existsSync, readFileSync, readdirSync, writeFileSync, renameSync, copyFileSync, mkdirSync, rmSync, appendFileSync } from 'node:fs'; ... L22: function pickNode() { L23: const nodeBin = process.env.NODE_OHOS; L24: if (!nodeBin) { L25: console.error('dsh-ohos: 未配置 NODE_OHOS 环境变量。'); L26: console.error(' dsh 需要 node >= 22.16(带原生 zstd), 推荐 node26。请在 ~/.zshrc 配置:'); L27: console.error(" export NODE_OHOS=\"$HOME/.harmonybrew/opt/node/bin/node\""); ... L43: function installedDshVersion() { L44: try { return JSON.parse(readFileSync(join(NM, '@deepseek-ai', 'dsh', 'package.json'), 'utf8')).

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/dsh-ohos.jsView on unpkg · L10

10// NODE_OHOS=/path/node dsh-ohos # 指定 node L11: import { spawn, spawnSync, execFileSync } from 'node:child_process'; L12: import { existsSync, readFileSync, readdirSync, writeFileSync, renameSync, copyFileSync, mkdirSync, rmSync, appendFileSync } from 'node:fs'; ... L22: function pickNode() { L23: const nodeBin = process.env.NODE_OHOS; L24: if (!nodeBin) { L25: console.error('dsh-ohos: 未配置 NODE_OHOS 环境变量。'); L26: console.error(' dsh 需要 node >= 22.16(带原生 zstd), 推荐 node26。请在 ~/.zshrc 配置:'); L27: console.error(" export NODE_OHOS=\"$HOME/.harmonybrew/opt/node/bin/node\""); ... L43: function installedDshVersion() { L44: try { return JSON.parse(readFileSync(join(NM, '@deepseek-ai', 'dsh', 'package.json'), 'utf8')).version || ''; } L45: catch { return ''; }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/dsh-ohos.jsView on unpkg · L10

scripts/smoke.mjsView file

4// → 带 cookie GET / 期待 200 → 杀进程。全链路通过 exit 0, 否则 exit 1(打印日志尾部)。 L5: import { spawn } from 'node:child_process'; L6: import { createServer } from 'node:net'; L7: import { join, dirname } from 'node:path'; ... L12: L13: if (!process.env.NODE_OHOS) { L14: console.error('smoke: 未配置 NODE_OHOS(见 README 环境要求)');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/smoke.mjsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.6.2 matchedPath = scripts/smoke.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/smoke.mjsView on unpkg

prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.nodeView file

•path = prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.node kind = native_binary sizeBytes = 72128 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.nodeView on unpkg

lib/patch.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.mjs#virtual:normalized:round1View on unpkg

lib/patch.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-harmonyos@0.4.0 matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.4.0 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/patch.mjsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 7-47json

7 "deepseek-harness",

8 "harmonyos",

9 "ohos",

10 "agent"

11 ],

12 "license": "MIT",

13 "type": "module",

14 "bin": {

15 "dsh-ohos": "./bin/dsh-ohos.js",

16 "dsh-harmonyos": "./bin/dsh-ohos.js"

17 },

18 "main": "lib/index.js",

19 "exports": {

20 ".": "./lib/index.js",

21 "./compat-loader": "./compat/compat-loader.mjs"

22 },

23 "engines": {

24 "node": ">=22.16.0"

25 },

26 "scripts": {

27 "postinstall": "node ./lib/patch.mjs patch && node ./lib/prune.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "patch": "node ./lib/patch.mjs patch",

29 "check": "node ./lib/patch.mjs check",

30 "prune": "node ./lib/prune.mjs",

31 "test": "node ./scripts/smoke.mjs"

32 },

33 "dependencies": {

34 "@deepseek-ai/dsh": "0.1.3-alpha.2",

35 "@deepseek-ai/dsh-host-directory-picker-auto": "^0.1.3-alpha.2",

36 "zstd-codec": "^0.1.5",

37 "@img/sharp-wasm32": "0.35.4"

38 },

39 "repository": {

40 "type": "git",

41 "url": "git+https://github.com/ystyle/dsh-harmonyos.git"

42 },

43 "homepage": "https://github.com/ystyle/dsh-harmonyos#readme",

44 "bugs": {

45 "url": "https://github.com/ystyle/dsh-harmonyos/issues"

46 }

47}

bin/dsh-ohos.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// dsh-ohos: DeepSeek Harness for HarmonyOS 启动器

3// - 定位本包 node_modules 里的官方 dsh

4// - 自动挑可用 node: 优先「带原生 zstd 的」(node>=22.16, 免 wasm 兼容层)

5// - 固定必要参数: --expose-internals --experimental-sqlite --experimental-loader compat

6// - 挂载 dsh-harmonyos overlay(原生行替换/禁用)

7// 用法:

8// dsh-ohos # 启动 web(127.0.0.1:3080, 作者默认)

9// dsh-ohos -- <官方dsh参数> # 透传(如 --profile headless "任务"、--port 3081)

10// NODE_OHOS=/path/node dsh-ohos # 指定 node

scripts/smoke.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// dsh-harmonyos 端到端冒烟测试 (npm test)

3// 流程: 起 dsh-ohos(随机空闲端口) → 等「dsh web: <token-url>」→ GET token URL 期待 303+set-cookie

4// → 带 cookie GET / 期待 200 → 杀进程。全链路通过 exit 0, 否则 exit 1(打印日志尾部)。

5import { spawn } from 'node:child_process';

6import { createServer } from 'node:net';

7import { join, dirname }

prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.nodeView file

•path = prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.node kind = native_binary sizeBytes = 72128 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.nodeView on unpkg

lib/patch.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.mjs#virtual:normalized:round1View on unpkg

lib/patch.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-harmonyos@0.4.0 matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.4.0 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/patch.mjsView on unpkg