registry / Remote code execution / dsh-jiuling-remote-desktop / 1.0.8

dsh-jiuling-remote-desktop@1.0.8

DSH 远程目录（电脑端）：把本机 DSH 会话的事件流经 Cloudflare 隧道搬到手机，手机进入电脑目录并发起对话，公网只传文本。含激活码配对流程。

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The source establishes a default public remote-control path authenticated by a fixed package-shared token. This is a dangerous capability that warrants a warning, though the behavior is presented as the product feature and does not establish a covert attack.

Static reason

No blocking static signals were detected.

Trigger

The plugin loads with default settings while cloudflared is available; tunnel startup can be disabled with autoTunnel=false.

Impact

A caller with the shared token may access remote session operations and submit prompts to the local agent.

Mechanism

The tunnel routes the public hostname to the local relay. The relay accepts the fixed token in a request header or query parameter and dispatches authenticated RPC calls to the host session controller.

AI rationale

Evidence

lib/index.js

Network endpoints1

dsh-remote.jiulingssh.xyz

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The source says the host and companion mobile package share a fixed default relay token.
Without a paired or file-provided tunnel token, the host falls back to its built-in tunnel credential, and tunnel startup is enabled by default.
The built-in tunnel routes the public hostname to the local relay.
The relay accepts the matching token from a header or query parameter as authentication.
Authenticated RPC requests reach the host handler, which accepts prompts for the local agent.

Evidence against

Tunnel startup can be disabled with autoTunnel=false and requires a cloudflared executable to be present.
The remote-control behavior is part of the package's stated remote desktop feature; the inspected source does not establish covert execution.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

7 flagged

lib/index.jsView file

Lines 48-132javascript

48 *

49 * - `POST /api/dsh-remote/rpc`：`{ id, method, params }` → `{ id, ok, result }`

50 * - `GET /api/dsh-remote/stream?session=<id>`：SSE，`event:` 是 durable 事件、

51 * `frame:` 是流式帧

52 *

53 * 选 SSE 而不是 WebSocket：手机 WebView 里 EventSource 是原生 API，断线自动重连

54 * 是浏览器内建的；WS 要自己写心跳与退避。Cloudflare 隧道对 SSE 的支持与普通

55 * HTTP 一致。

56 *

57 * ## ⚠️ 丢帧是安全的（实测结论）

58 *

59 * 手机端 `ClientAssistantStream.acceptFrame()` 遇到不连续的帧返回

60 * `{ type: 'rebaseline' }`，消费点是 `events.restart()` —— 即重连重拉基线。

61 * 而 **host 侧的帧永不丢**（进程内事件），重连后从 baseline 能补齐全部已生成内容。

62 * 所以这条通道可以做成 best-effort，不必自己设计序号补洞。

63 *

64 * @module dsh-remote-desktop

65 */

67import { createServer } from 'node:http';

68import { randomUUID } from 'node:crypto';

69import { spawn } from 'node:child_process';

70import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L68

71import { homedir } from 'node:os';

72import { isAbsolute, dirname, join, resolve } from 'node:path';

73import { createPairing, PAIR_ENDPOINT } from './pair.js';

75export const name = 'dsh-jiuling-remote-desktop';

77/**

78 * `sessionController` 提供官方的建会话/发消息/中断命令层；`sessions` 用于

79 * SSE 开场补发历史；中继 HTTP 服务由本插件自建（不用 `webServer`，因为

80 * `webServer` 挂在 DSH 自己的 Web 端口上，而隧道的 ingress 指向独立端口 17890）。

81 *

82 * `webServer` 是给**配对界面**用的：客户端半边要能填激活码、看二维码，

83 * 那条路走的是 DSH 自己的 Web 端口（与中继端口无关）。

84 */

85export const inject = ['sessionController', 'sessions', 'webServer'];

87/** 中继监听端口。与 Cloudflare 隧道的 ingress 必须一致。 */

88const RELAY_PORT = 17890;

90/** 配对界面的路由前缀（挂在 DSH 自己的 Web 端口上）。 */

91const PAIR_ROUTE = '/api/dsh-remote/pair';

93/** 配置与状态落在 $DSH_HOME 下的这个目录。 */

94const STATE_DIR = join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), 'dsh-remote');

96/** 访问令牌文件。手机端要用同一个令牌才能连上。 */

97const TOKEN_PATH = join(STATE_DIR, 'token.txt');

99/** 隧道凭据文件（可选：覆盖内置的隧道令牌）。 */

100const TUNNEL_PATH = join(STATE_DIR, 'tunnel.txt');

101

102/**

103 * 内置访问令牌 —— **必须与 `dsh-jiuling-remote-mobile` 里的内置值逐字相同**。

104 *

105 * 两端同值 ⇒ 装完即可连通，用户不用手工同步任何东西。想隔离就改这个文件：

106 * 电脑端 `<DSH_HOME>/dsh-remote/token.txt` 与手机端

107 * `<DSH_HOME>/dsh-remote/mobile.json` 的 `token` 字段，两边改成一样的即可。

108 */

109const DEFAULT_TOKEN = 'f6721b0cf82414709df172056193c78a6c374e9a920e51145dd7883923cf16e7';

110

111/**

112 * 内置 Cloudflare 隧道令牌（账号 `cf45cf053dfe24156bfcad084a02b884` 下的

113 * `dsh-remote` 隧道，ingress = `dsh-remote.jiulingssh.xyz` → `localhost:17890`）。

Medium

Ai Review Evidence

The source says the host and companion mobile package share a fixed default relay token.

lib/index.jsView on unpkg · L103

114 *

115 * 装完即用，不必再去 Cloudflare 后台复制。要换成自己的隧道就改

Medium

Ai Review Evidence

The built-in tunnel routes the public hostname to the local relay.

lib/index.jsView on unpkg · L112

116 * `<DSH_HOME>/dsh-remote/tunnel.txt`，或在插件 config 里给 `tunnelToken`。

117 */

118const DEFAULT_TUNNEL_TOKEN =

119 'eyJhIjoiY2Y0NWNmMDUzZGZlMjQxNTZiZmNhZDA4NGEwMmI4ODQiLCJ0IjoiYTk4MjA2ZmEtNmEzOC00N2NiLWFhMGQtNTQxZDRjNTg2YjQyIiwicyI6IlJFdng4NU8zNlhtOTc0M0hLSk9nb3M1WUJsUGFsVkZKZWl4UitRQUwxTHpOWG10ZURTY0dCWHZydEU1MmFMNHc4ajBsTlBTVjdvZHl1a0M5b1g3ayt3PT0ifQ==';

120

121/**

122 * 找 cloudflared 可执行文件。

123 *

124 * @returns 可执行文件路径，或 `undefined`（未安装）。

125 */

126function findCloudflared() {

127 // ⚠️ `<STATE_DIR>/bin/` 这一条不能少：配对流程会自动把 cloudflared 下到这里

128 //（见 `pair.js` 的 `ensureCloudflared`），而客户机上通常别处都没有它。

129 // 漏了这一条的症状很隐蔽 —— 配对「成功」、隧道却起不来，

130 // 日志里只有一句「未找到 cloudflared」。

131 const binDir = join(STATE_DIR, 'bin');

132 const candidates = [

Lines 570-610javascript

570 current?.kill();

571 } catch {

572 /* 已退出 */

573 }

574 if (typeof token !== 'string' || token.length < 16) {

Lines 733-773javascript

733 // ---- 配对路由（挂在本机 Web 端口上） ----

734 //

735 // ⚠️ 只注册 `prefix` 一条：`register()` 对重复的 `(kind, path)` 会**抛错**

736 //（`webserver: duplicate ...`），而 exact 与 prefix 是两张表 —— 同时注册

737 // 同一个 path 虽然不冲突，但 exact 永远先命中，等于白写一条。

738 // 前缀匹配已经覆盖 `/api/dsh-remote/pair` 与它的全部子路径。

739 if (typeof ctx.webServer?.register === 'function') {

lib/index.js#virtual:normalized:round1View file

234// 而 win32 下 `isAbsolute("C:") === false` ⇒ 点「上一级」直接报错。 L235: // dirname("C:Users") = "C:'，dirname("C:\") = "C:\"（等于自身 ⇒ 到顶了）。\n\tconst up = dirname(abs);\n\tconst parent = up === abs ? "" : up;\n\t// 站在驱动器根上（parent 为空）时，把其它盘符一并列出来当出口。\n\tif ... L236: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.js#virtual:normalized:round1View on unpkg · L234

lib/pair.jsView file

Lines 33-73javascript

33 * 真正的令牌由手机直接向服务器换取。所以哪怕二维码被人拍到，

34 * 泄露的也只是一次性的、10 分钟就过期的短码。

35 *

36 * ## 为什么二维码里只有 6 位码，没有别的

37 *

38 * 试过编码成 `dsh-pair:A7K2M9`

Source & flagged code

7 flagged · loading source

lib/index.jsView file

68import { randomUUID } from 'node:crypto'; L69: import { spawn } from 'node:child_process'; L70: import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L68

103* 内置访问令牌 —— **必须与 `dsh-jiuling-remote-mobile` 里的内置值逐字相同**。 * * 两端同值 ⇒ 装完即可连通，用户不用手工同步任何东西。想隔离就改这个文件： * 电脑端 `<DSH_HOME>/dsh-remote/token.txt` 与手机端 * `<DSH_HOME>/dsh-remote/mobile.json` 的 `token` 字段，两边改成一样的即可。 */ const DEFAULT_TOKEN = '[redacted]'; /** * 内置 Cloudflare 隧道令牌（账号 `[redacted]` 下的 * `dsh-r

Medium

Ai Review Evidence

The source says the host and companion mobile package share a fixed default relay token.

lib/index.jsView on unpkg · L103

590function readTunnelToken(paired) { if (typeof paired?.tunnelToken === 'string' && paired.tunnelToken.length >= 16) { return paired.tunnelToken; } try { const value = readFileSync(TUNNEL_PATH, 'utf8').trim(); return value === '' ? DEFAULT_TUNNEL_TOKEN : value; } catch { return DEFAULT_TUN

Medium

Ai Review Evidence

Without a paired or file-provided tunnel token, the host falls back to its built-in tunnel credential, and tunnel startup is enabled by default.

Findings

3 High6 Medium3 Low

HighChild Processlib/index.js

HighSame File Env Network Executionlib/index.js#virtual:normalized:round1

HighRemote System File Writelib/pair.js

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencelib/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to dsh-jiuling-remote-desktop@1.0.8.

See all versions of dsh-jiuling-remote-desktop for other recorded verdicts.

Review the evidence and your use of dsh-jiuling-remote-desktop@1.0.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 18:19:29.496Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.