registry / Remote code execution / dsh-jiuling-remote-desktop

dsh-jiuling-remote-desktop

DSH 远程目录（电脑端）：把本机 DSH 会话的事件流经 Cloudflare 隧道搬到手机，手机进入电脑目录并发起对话，公网只传文本。含激活码配对流程。

This report shows the evidence for dsh-jiuling-remote-desktop@1.0.11. 1 of 29 known versions is blocked or flagged. The newest version, 1.0.41, is allowed. See all versions.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The advertised remote desktop feature is package-aligned, but the default tunnel and shared bundled credentials expose local agent control without requiring per-device pairing. That is a concrete remote control backdoor, so block publication.

Static reason

No blocking static signals were detected.

Trigger

DSH loads the plugin with default configuration and no per-device paired credentials.

Impact

Remote parties with the shared credential can inspect directory metadata and ask the local agent to perform actions, potentially exposing files or causing consequential actions through its tools.

Mechanism

The plugin starts cloudflared using its built-in tunnel credential; the local relay accepts the bundled shared access token and dispatches authenticated RPC requests to the DSH agent and filesystem directory listing.

Attack narrative

Default plugin activation starts a public tunnel before per-device pairing. The same bundled access credential is documented as matching the companion app, and the relay uses it to authorize remote prompts and directory listing. This creates a shared remote control path into local DSH sessions.

AI rationale

Evidence

lib/index.js

Network endpoints1

dsh-remote.jiulingssh.xyz

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest describes a remote desktop that relays local DSH sessions through a Cloudflare tunnel to a phone.
Without per-device pairing or a custom token file, the host uses a bundled default access token that the source says matches the companion mobile package; the relay accepts it in a header or query parameter.
With default configuration, the host uses a built-in tunnel credential and starts cloudflared, routing the fixed public tunnel to the local relay.
Authenticated RPC forwards supplied text to the local DSH agent and allows remote directory listing.

Evidence against

Remote access is the package’s advertised feature, and activation-code pairing can issue per-device credentials; that pairing flow does not gate startup of the shared default tunnel.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

7 flagged

lib/index.jsView file

Lines 48-123javascript

48 *

49 * - `POST /api/dsh-remote/rpc`：`{ id, method, params }` → `{ id, ok, result }`

50 * - `GET /api/dsh-remote/stream?session=<id>`：SSE，`event:` 是 durable 事件、

51 * `frame:` 是流式帧

52 *

53 * 选 SSE 而不是 WebSocket：手机 WebView 里 EventSource 是原生 API，断线自动重连

54 * 是浏览器内建的；WS 要自己写心跳与退避。Cloudflare 隧道对 SSE 的支持与普通

55 * HTTP 一致。

56 *

57 * ## ⚠️ 丢帧是安全的（实测结论）

58 *

59 * 手机端 `ClientAssistantStream.acceptFrame()` 遇到不连续的帧返回

60 * `{ type: 'rebaseline' }`，消费点是 `events.restart()` —— 即重连重拉基线。

61 * 而 **host 侧的帧永不丢**（进程内事件），重连后从 baseline 能补齐全部已生成内容。

62 * 所以这条通道可以做成 best-effort，不必自己设计序号补洞。

63 *

64 * @module dsh-remote-desktop

65 */

67import { createServer } from 'node:http';

68import { randomUUID } from 'node:crypto';

69import { spawn } from 'node:child_process';

70import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L68

71import { homedir } from 'node:os';

72import { isAbsolute, dirname, join, resolve } from 'node:path';

73import { createPairing, PAIR_ENDPOINT } from './pair.js';

75export const name = 'dsh-jiuling-remote-desktop';

77/**

78 * `sessionController` 提供官方的建会话/发消息/中断命令层；`sessions` 用于

79 * SSE 开场补发历史；中继 HTTP 服务由本插件自建（不用 `webServer`，因为

80 * `webServer` 挂在 DSH 自己的 Web 端口上，而隧道的 ingress 指向独立端口 17890）。

81 *

82 * `webServer` 是给**配对界面**用的：客户端半边要能填激活码、看二维码，

83 * 那条路走的是 DSH 自己的 Web 端口（与中继端口无关）。

84 */

85export const inject = ['sessionController', 'sessions', 'webServer'];

87/** 中继监听端口。与 Cloudflare 隧道的 ingress 必须一致。 */

88const RELAY_PORT = 17890;

90/** 配对界面的路由前缀（挂在 DSH 自己的 Web 端口上）。 */

91const PAIR_ROUTE = '/api/dsh-remote/pair';

93/** 配置与状态落在 $DSH_HOME 下的这个目录。 */

94const STATE_DIR = join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), 'dsh-remote');

96/** 访问令牌文件。手机端要用同一个令牌才能连上。 */

97const TOKEN_PATH = join(STATE_DIR, 'token.txt');

99/** 隧道凭据文件（可选：覆盖内置的隧道令牌）。 */

100const TUNNEL_PATH = join(STATE_DIR, 'tunnel.txt');

101

102/**

103 * 内置访问令牌 —— **必须与 `dsh-jiuling-remote-mobile` 里的内置值逐字相同**。

104 *

105 * 两端同值 ⇒ 装完即可连通，用户不用手工同步任何东西。想隔离就改这个文件：

106 * 电脑端 `<DSH_HOME>/dsh-remote/token.txt` 与手机端

107 * `<DSH_HOME>/dsh-remote/mobile.json` 的 `token` 字段，两边改成一样的即可。

High

Ai Review Evidence

Without per-device pairing or a custom token file, the host uses a bundled default access token that the source says matches the companion mobile package; the relay accepts it in a header or query parameter.

lib/index.jsView on unpkg · L103

108 */

109const DEFAULT_TOKEN = 'f6721b0cf82414709df172056193c78a6c374e9a920e51145dd7883923cf16e7';

110

111/**

112 * 内置 Cloudflare 隧道令牌（账号 `cf45cf053dfe24156bfcad084a02b884` 下的

113 * `dsh-remote` 隧道，ingress = `dsh-remote.jiulingssh.xyz` → `localhost:17890`）。

114 *

115 * 装完即用，不必再去 Cloudflare 后台复制。要换成自己的隧道就改

116 * `<DSH_HOME>/dsh-remote/tunnel.txt`，或在插件 config 里给 `tunnelToken`。

117 */

118const DEFAULT_TUNNEL_TOKEN =

119 'eyJhIjoiY2Y0NWNmMDUzZGZlMjQxNTZiZmNhZDA4NGEwMmI4ODQiLCJ0IjoiYTk4MjA2ZmEtNmEzOC00N2NiLWFhMGQtNTQxZDRjNTg2YjQyIiwicyI6IlJFdng4NU8zNlhtOTc0M0hLSk9nb3M1WUJsUGFsVkZKZWl4UitRQUwxTHpOWG10ZURTY0dCWHZydEU1MmFMNHc4ajBsTlBTVjdvZHl1a0M5b1g3ayt3PT0ifQ==';

120

121/**

122 * 找 cloudflared 可执行文件。

123 *

Lines 142-182javascript

142}

143

144/**

145 * 决定中继的访问令牌。

146 *

147 * ## 优先级（这是配对能自动生效的关键）

148 *

149 * 1. **配对凭据里的 `accessToken`** —— 手机扫码后从服务器 claim 到的就是它，

150 * 两端因此**不需要任何手工同步**。这是面向大众分发的主路径。

151 * 2. `token.txt` 文件 —— 老用户 / 想自己换令牌的人走这条。

152 * 3. 内置 `DEFAULT_TOKEN` —— 既没配对也没文件的兜底。

153 *

154 * ⚠️ 顺序不能反。若把文件放第一位，客户配对成功后令牌仍是内置值，

Lines 382-422javascript

382 };

383

384 // ---- durable 通道：落盘的事件 ----

385 ctx.on(

386 'session/event',

387 (session, event) => {

388 push(session.id, 'event', event);

389 },

lib/index.js#virtual:normalized:round1View file

234// 而 win32 下 `isAbsolute("C:") === false` ⇒ 点「上一级」直接报错。 L235: // dirname("C:Users") = "C:'，dirname("C:\") = "C:\"（等于自身 ⇒ 到顶了）。\n\tconst up = dirname(abs);\n\tconst parent = up === abs ? "" : up;\n\t// 站在驱动器根上（parent 为空）时，把其它盘符一并列出来当出口。\n\tif ... L236: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.js#virtual:normalized:round1View on unpkg · L234

lib/pair.jsView file

Lines 33-73javascript

33 * 真正的令牌由手机直接向服务器换取。所以哪怕二维码被人拍到，

34 * 泄露的也只是一次性的、10 分钟就过期的短码。

35 *

36 * ## 为什么二维码里只有 6 位码，没有别的

37 *

38 * 试过编码成 `dsh-pair:A7K2M9`

package.jsonView file

Lines 1-21json

2 "name": "dsh-jiuling-remote-desktop",

3 "version": "1.0.11",

4 "description": "DSH 远程目录（电脑端）：把本机 DSH 会话的事件流经 Cloudflare 隧道搬到手机，手机进入电脑目录并发起对话，公网只传文本。含激活码配对流程。",

High

Ai Review Evidence

The manifest describes a remote desktop that relays local DSH sessions through a Cloudflare tunnel to a phone.

package.jsonView on unpkg · L1

Source & flagged code

7 flagged · loading source

lib/index.jsView file

68import { randomUUID } from 'node:crypto'; L69: import { spawn } from 'node:child_process'; L70: import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L68

103* 内置访问令牌 —— **必须与 `dsh-jiuling-remote-mobile` 里的内置值逐字相同**。 * * 两端同值 ⇒ 装完即可连通，用户不用手工同步任何东西。想隔离就改这个文件： * 电脑端 `<DSH_HOME>/dsh-remote/token.txt` 与手机端 * `

High

Ai Review Evidence

lib/index.jsView on unpkg · L103

162function ensureToken(ctx, paired) { if (typeof paired?.accessToken === 'string' && paired.accessToken.length >= 16) { return paired.accessToken; } try { const existing = readFileSync(TOKEN_PATH, 'utf8').trim(); if (existing.length >= 16) return existing; } catch { /* 文件不存在：下面落盘一份内置值 */ } try { mkdirSync(STATE_DIR, { recursive: true }); writeFileSync(TOKEN_PATH, DEFAULT_TOKEN, { mode: 0o600 }); } catch (error) { ctx.logger?.warn?.(`[dsh-remote] 写令牌文件失败

High

Findings

7 High2 Medium3 Low

HighChild Processlib/index.js

HighSame File Env Network Executionlib/index.js#virtual:normalized:round1

HighRemote System File Writelib/pair.js

HighAi Review Evidencepackage.json

HighAi Review Evidencelib/index.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to dsh-jiuling-remote-desktop@1.0.11.

The versions list below shows the verdict for each recorded version.

Avoid installing dsh-jiuling-remote-desktop@1.0.11. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-15 19:45:58.398Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

29 known versions

1.0.41latestUnknown—AllowUnder ReviewOct 22, 2026, 8:05 AM 1.0.39Unknown—AllowUnder ReviewOct 22, 2026, 1:29 AM 1.0.36Unknown—AllowUnder ReviewOct 21, 2026, 9:55 AM 1.0.30Unknown—AllowUnder ReviewOct 20, 2026, 3:00 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code