registry / dsh-jiuling-remote-desktop / 1.0.2

dsh-jiuling-remote-desktop@1.0.2

⚠ Under review

DSH 远程目录（电脑端）：把本机 DSH 会话的事件流经 Cloudflare 隧道搬到手机，手机进入电脑目录并发起对话，公网只传文本。

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 19.4 KB of source, external domains: 127.0.0.1

Source & flagged code

2 flagged

lib/index.jsView file

Lines 48-88javascript

48 *

49 * - `POST /api/dsh-remote/rpc`：`{ id, method, params }` → `{ id, ok, result }`

50 * - `GET /api/dsh-remote/stream?session=<id>`：SSE，`event:` 是 durable 事件、

51 * `frame:` 是流式帧

52 *

53 * 选 SSE 而不是 WebSocket：手机 WebView 里 EventSource 是原生 API，断线自动重连

54 * 是浏览器内建的；WS 要自己写心跳与退避。Cloudflare 隧道对 SSE 的支持与普通

55 * HTTP 一致。

56 *

57 * ## ⚠️ 丢帧是安全的（实测结论）

58 *

59 * 手机端 `ClientAssistantStream.acceptFrame()` 遇到不连续的帧返回

60 * `{ type: 'rebaseline' }`，消费点是 `events.restart()` —— 即重连重拉基线。

61 * 而 **host 侧的帧永不丢**（进程内事件），重连后从 baseline 能补齐全部已生成内容。

62 * 所以这条通道可以做成 best-effort，不必自己设计序号补洞。

63 *

64 * @module dsh-remote-desktop

65 */

67import { createServer } from 'node:http';

68import { randomUUID } from 'node:crypto';

69import { spawn } from 'node:child_process';

70import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L68

71import { homedir } from 'node:os';

72import { isAbsolute, dirname, join, resolve } from 'node:path';

74export const name = 'dsh-jiuling-remote-desktop';

76/**

77 * `sessionController` 提供官方的建会话/发消息/中断命令层；`sessions` 用于

78 * SSE 开场补发历史；中继 HTTP 服务由本插件自建（不用 `webServer`，因为

79 * `webServer` 挂在 DSH 自己的 Web 端口上，而隧道的 ingress 指向独立端口 17890）。

80 */

81export const inject = ['sessionController', 'sessions'];

83/** 中继监听端口。与 Cloudflare 隧道的 ingress 必须一致。 */

84const RELAY_PORT = 17890;

86/** 配置与状态落在 $DSH_HOME 下的这个目录。 */

87const STATE_DIR = join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), 'dsh-remote');

lib/index.js#virtual:normalized:round1View file

209// 而 win32 下 `isAbsolute("C:") === false` ⇒ 点「上一级」直接报错。 L210: // dirname("C:Users") = "C:'，dirname("C:\") = "C:\"（等于自身 ⇒ 到顶了）。\n\tconst up = dirname(abs);\n\tconst parent = up === abs ? "" : up;\n\t// 站在驱动器根上（parent 为空）时，把其它盘符一并列出来当出口。\n\tif ... L211: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.js#virtual:normalized:round1View on unpkg · L209

Source & flagged code

2 flagged · loading source

lib/index.jsView file

68import { randomUUID } from 'node:crypto'; L69: import { spawn } from 'node:child_process'; L70: import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L68

lib/index.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.js#virtual:normalized:round1View on unpkg · L209

Findings

2 High2 Medium3 Low

HighChild Processlib/index.js

HighSame File Env Network Executionlib/index.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to dsh-jiuling-remote-desktop@1.0.2.

See all versions of dsh-jiuling-remote-desktop for other recorded verdicts.

Review the evidence and your use of dsh-jiuling-remote-desktop@1.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 12:44:53.727Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.