registry / dsh-jiuling-remote-desktop / 1.0.15

dsh-jiuling-remote-desktop@1.0.15

DSH 远程目录（电脑端）：把本机 DSH 会话的事件流经 Cloudflare 隧道搬到手机，手机进入电脑目录并发起对话，公网只传文本。含激活码配对流程。

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Source inspection found no install hook or confirmed attack behavior. The remote executable download and tunnel setup are part of the package’s pairing flow and are activated through user pairing.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The relay starts when the plugin loads; pairing and cloudflared download require a user-submitted activation code.

Impact

The intended feature exposes the user’s DSH sessions and workspace through the paired remote service; inspected source did not establish malicious use.

Mechanism

The relay listens locally and can start a tunnel when a token is available. Pairing downloads cloudflared from the package’s HTTPS service.

AI rationale

Source inspection found no install hook or confirmed attack behavior. The remote executable download and tunnel setup are part of the package’s pairing flow and are activated through user pairing.

Evidence

lib/pair.jslib/index.js

Network endpoints2

pair.jiulingssh.xyz127.0.0.1:17890

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points to the inspected runtime entrypoint and contains no lifecycle scripts.
The pairing code fetches cloudflared from the package’s HTTPS pairing service and saves it for the tunnel feature.
The executable download is triggered after a user submits an activation code to register pairing.
The relay listens on localhost; the tunnel starts only when a token is configured or available from pairing.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 104 KB of source, external domains: 127.0.0.1, pair.jiulingssh.xyz, www.w3.org

Source & flagged code

7 flagged

lib/pair.jsView file

Lines 33-73javascript

33 * 真正的令牌由手机直接向服务器换取。所以哪怕二维码被人拍到，

34 * 泄露的也只是一次性的、10 分钟就过期的短码。

35 *

36 * ## 为什么二维码里只有 6 位码，没有别的

37 *

38 * 试过编码成 `dsh-pair:A7K2M9` 这种带 scheme 的串，好处是将来能扩展，

39 * 坏处是**用户拿系统相机扫出来的就是一串看不懂的东西**，还得自己从中

40 * 抠出那 6 位。而现在扫出来就是 `A7K2M9`，照着输即可 —— 面向大众分发时

41 * 「扫不出也能照抄」比「协议优雅」重要得多。

42 *

43 * @module dsh-remote-desktop/pair

44 */

46import { chmodSync, createWriteStream, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';

47import { homedir, hostname as osHostname } from 'node:os';

48import { join } from 'node:path';

49import { Readable } from 'node:stream';

50import { pipeline } from 'node:stream/promises';

51import { qrSvg } from './qr.js';

53/** 配对服务的公网地址（Cloudflare 隧道，走 HTTPS）。 */

54export const PAIR_ENDPOINT = 'https://pair.jiulingssh.xyz';

Low

Ai Review Evidence

The pairing code fetches cloudflared from the package’s HTTPS pairing service and saves it for the tunnel feature.

lib/pair.jsView on unpkg · L53

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

lib/pair.jsView on unpkg · L53

56/**

57 * 平台 → cloudflared 文件名。

58 *

59 * 与服务器上 `/pair/cloudflared/` 的白名单**必须一致**，改一边就得改另一边。

60 * 只列我们真的分发过的四个：Windows x64、Linux x64、macOS x64 / arm64。

61 */

62const PLATFORM_FILES = {

63 'win32-x64': 'cloudflared-windows-amd64.exe',

64 'linux-x64': 'cloudflared-linux-amd64',

65 'darwin-x64': 'cloudflared-darwin-amd64',

66 'darwin-arm64': 'cloudflared-darwin-arm64',

67};

69/**

70 * 带超时的配对服务请求。

71 *

72 * ⚠️ 不用 `AbortSignal.timeout()`：那个 API 要 Node 17.3+，而这里宁可自己拿

73 * `AbortController` + `setTimeout` 拼一次，省得为一个便利函数抬高版本要求。

Lines 275-315javascript

275 if (cached !== undefined) return { ok: true, path: cached, cached: true, message: '已找到 cloudflared' };

276

277 const fileName = PLATFORM_FILES[`${process.platform}-${

lib/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/index.js#virtual:normalized:round1View on unpkg

lib/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-jiuling-remote-desktop@1.0.13 matchedIdentity = npm:[redacted]:1.0.13 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/index.jsView on unpkg

package.jsonView file

Lines 1-38json

2 "name": "dsh-jiuling-remote-desktop",

3 "version": "1.0.15",

4 "description": "DSH 远程目录（电脑端）：把本机 DSH 会话的事件流经 Cloudflare 隧道搬到手机，手机进入电脑目录并发起对话，公网只传文本。含激活码配对流程。",

5 "type": "module",

Source & flagged code

7 flagged · loading source

lib/pair.jsView file

53/** 配对服务的公网地址（Cloudflare 隧道，走 HTTPS）。 */ L54: export const PAIR_ENDPOINT = 'https://pair.jiulingssh.xyz'; L55: ... L86: headers: body === undefined ? {} : { 'content-type': 'application/json' }, L87: body: body === undefined ? undefined : JSON.stringify(body), L88: signal: controller.signal, L89: }); L90: const text = await response.text(); L91: let payload; ... L198: code, L199: device: osHostname(), L200: });

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

lib/pair.jsView on unpkg · L53

53/** 配对服务的公网地址（Cloudflare 隧道，走 HTTPS）。 */ export const PAIR_ENDPOINT = 'https://pair.jiul

Low

Ai Review Evidence

The pairing code fetches cloudflared from the package’s HTTPS pairing service and saves it for the tunnel feature.

lib/pair.jsView on unpkg · L53

295const controller = new AbortController(); const timer = setTimeout(() => controller.abort(), 300000); try { const response = await fetch(`${PAIR_ENDPOINT}/pair/cloudflared/${fileName}`, { signal: controller.signal, }); if (!response.ok || response.body === null) { throw new Error(`HTTP ${response

Low

Ai Review Evidence

The pairing code fetches cloudflared from the package’s HTTPS pairing service and saves it for the tunnel feature.

lib/pair.jsView on unpkg · L295

lib/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/index.js#virtual:normalized:round1View on unpkg

lib/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/index.jsView on unpkg

package.jsonView file

5"type": "module", "main": "./lib/index.js", "exports": { ".": "./lib/index.js", "./client": "./lib/client.js", "./package.json": "./package.json" }, "keywords": [

Low

Suspicious Lifecycle Evidence

The manifest points to the inspected runtime entrypoint and contains no lifecycle scripts.

package.jsonView on unpkg · L5

29"license": "MIT", "files": [ "lib", "cordis.patch.yml" ], "engines": { "node": ">=20" } }

Low

Suspicious Lifecycle Evidence

The manifest points to the inspected runtime entrypoint and contains no lifecycle scripts.

package.jsonView on unpkg · L29

Findings

3 High2 Medium7 Low

HighRemote System File Writelib/pair.js

HighSemantic Analysis Limitedlib/index.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltalib/index.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencelib/pair.js

Affected versions and remediation

This report applies to dsh-jiuling-remote-desktop@1.0.15.

See all versions of dsh-jiuling-remote-desktop for other recorded verdicts.

Review the evidence and your use of dsh-jiuling-remote-desktop@1.0.15 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 11:19:47.989Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.