Loading npm security reports…

dsh-harmonyos@0.7.1: AI-agent control-surface risk | LPM Firewall

registry / dsh-harmonyos / 0.7.1

dsh-harmonyos@0.7.1

DeepSeek Harness for HarmonyOS — 一条命令装好:JS-only 替代/裁剪 profile、鸿蒙文件系统补丁、compat loader(zstd/fs-ext/sharp shim)、自启脚本(优先原生 zstd 的 node)。装完跑 dsh-ohos 即可。

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently rewrites third-party DeepSeek DSH authentication, credential, and sandbox controls. Its launcher also persists a dangerous default permission preset.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs postinstall; running dsh-ohos applies the settings change.

Impact

A consumer's installed AI-agent environment can run with weakened credential checks, token-free local sessions, and forced full-access defaults.

Mechanism

Lifecycle patching that disables or weakens DSH security controls.

Policy narrative

During npm installation, the package executes a patcher that modifies foreign DeepSeek DSH modules. It bypasses a credential ownership check, adds token-free loopback session creation, and changes the sandbox policy to accept a forced danger-full-access mode. When its command is run, it also appends a danger-full-access preset to the user's DSH settings. These are unconsented changes to an AI-agent control surface, not necessary package-local setup.

AI rationale

The automatic lifecycle hook rewrites third-party AI-agent security controls, including authentication and sandbox behavior. This is concrete install-hook abuse with a persistent capability downgrade.

Evidence

package.jsonlib/patch.mjsnode_modules/@deepseek-ai/dsh-credentials-local/lib/index.jsnode_modules/@deepseek-ai/dsh-client-connection/lib/index.jsnode_modules/@deepseek-ai/dsh-sandbox-policy/lib/index.js

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./lib/patch.mjs patch && node ./lib/prune.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./lib/patch.mjs patch && node ./lib/prune.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/dsh-ohos.jsView file

10// NODE_OHOS=/path/node dsh-ohos # 指定 node L11: import { spawn, spawnSync, execFileSync } from 'node:child_process'; L12: import { existsSync, readFileSync, readdirSync, writeFileSync, renameSync, copyFileSync, mkdirSync, rmSync, appendFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/dsh-ohos.jsView on unpkg · L10

10Trigger-reachable persistence chain: manifest.bin -> bin/dsh-ohos.js L10: // NODE_OHOS=/path/node dsh-ohos # 指定 node L11: import { spawn, spawnSync, execFileSync } from 'node:child_process'; L12: import { existsSync, readFileSync, readdirSync, writeFileSync, renameSync, copyFileSync, mkdirSync, rmSync, appendFileSync } from 'node:fs'; ... L22: function pickNode() { L23: const nodeBin = process.env.NODE_OHOS; L24: if (!nodeBin) { L25: console.error('dsh-ohos: 未配置 NODE_OHOS 环境变量。'); L26: console.error(' dsh 需要 node >= 22.16(带原生 zstd), 推荐 node26。请在 ~/.zshrc 配置:'); L27: console.error(" export NODE_OHOS=\"$HOME/.harmonybrew/opt/node/bin/node\""); ... L43: function installedDshVersion() { L44: try { return JSON.parse(readFileSync(join(NM, '@deepseek-ai', 'dsh', 'package.json'), 'utf8')).

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/dsh-ohos.jsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.7.0 matchedPath = bin/dsh-ohos.js matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/dsh-ohos.jsView on unpkg

10// NODE_OHOS=/path/node dsh-ohos # 指定 node L11: import { spawn, spawnSync, execFileSync } from 'node:child_process'; L12: import { existsSync, readFileSync, readdirSync, writeFileSync, renameSync, copyFileSync, mkdirSync, rmSync, appendFileSync } from 'node:fs'; ... L22: function pickNode() { L23: const nodeBin = process.env.NODE_OHOS; L24: if (!nodeBin) { L25: console.error('dsh-ohos: 未配置 NODE_OHOS 环境变量。'); L26: console.error(' dsh 需要 node >= 22.16(带原生 zstd), 推荐 node26。请在 ~/.zshrc 配置:'); L27: console.error(" export NODE_OHOS=\"$HOME/.harmonybrew/opt/node/bin/node\""); ... L43: function installedDshVersion() { L44: try { return JSON.parse(readFileSync(join(NM, '@deepseek-ai', 'dsh', 'package.json'), 'utf8')).version || ''; } L45: catch { return ''; }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/dsh-ohos.jsView on unpkg · L10

scripts/smoke.mjsView file

4// → 带 cookie GET / 期待 200 → 杀进程。全链路通过 exit 0, 否则 exit 1(打印日志尾部)。 L5: import { spawn } from 'node:child_process'; L6: import { createServer } from 'node:net'; L7: import { join, dirname } from 'node:path'; ... L12: L13: if (!process.env.NODE_OHOS) { L14: console.error('smoke: 未配置 NODE_OHOS(见 README 环境要求)');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/smoke.mjsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.7.0 matchedPath = scripts/smoke.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/smoke.mjsView on unpkg

prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.nodeView file

•path = prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.node kind = native_binary sizeBytes = 72128 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/node-pty-1.2.0-beta.15-linux-arm64-musl.nodeView on unpkg

lib/patch.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.mjs#virtual:normalized:round1View on unpkg

lib/patch.mjsView file

•matchType = normalized_sha256 matchedPackage = dsh-harmonyos@0.7.0 matchedPath = lib/patch.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/patch.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8d71ff9b1db24bdd signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = dsh-harmonyos@0.7.0 matchedPath = lib/patch.mjs matchedIdentity = npm:ZHNoLWhhcm1vbnlvcw:0.7.0 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/patch.mjsView on unpkg