registry / dsh-oc / 0.3.21

dsh-oc@0.3.21

DeepSeek Harness 插件全家桶聚合安装器:一条命令装齐壳/会话新窗口/深链/右侧工作台/逐轮产出物卡片/会话撤回(并为引擎补齐撤回所需 truncate 补丁;无功能代码,各功能为独立插件)

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 19.5 KB of source, external domains: npmmirror.com, registry.npmjs.org

Source & flagged code

3 flagged

bin/dsh-oc.cjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2'use strict';

3// dsh-oc aggregate installer: install every independent plugin in one command.

4const { spawn, spawnSync } = require('node:child_process');

5const fs = require('node:fs');

6const os = require('node:os');

7const path = require('node:path');

8const readline = require('node:readline/promises');

9const { stdin, stdout } = require('node:process');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/dsh-oc.cjsView on unpkg · L3

11// Plugins the aggregate installs. dsh-oc-change-review is intentionally NOT here:

12// it registers the same conversation.chat.turnTail slot as dsh-oc-file-links, so having

13// both installed makes one silently win (and the review card/产出物 card compete).

14const AGGREGATE = ["dsh-oc-session-window", "dsh-oc-deeplink", "dsh-oc-sidebar", "dsh-oc-file-links", "dsh-oc-message-undo", "@huanlin/dsh-plugin-better-sidebar-plugin-office"];

16// Plugins that must be REMOVED from an existing profile on install (old computers may

17// still have them from a previous aggregate version). They conflict with the current set.

18const REMOVE_ON_INSTALL = ["dsh-oc-change-review"];

20// Package names that must never live in a profile: they are either the old

21// aggregate plugin (dsh-oc 0.x bundled its own shell+sidebar and double-mounts

22// /sidebar/api with dsh-oc-sidebar, crashing the engine) or old pre-rename

23// names. The current dsh-oc is a pure installer and never enters the profile.

•matchType = previous_version_dangerous_delta matchedPackage = dsh-oc@0.3.20 matchedIdentity = npm:ZHNoLW9j:0.3.20 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/dsh-oc.cjsView on unpkg

install.ps1View file

•path = install.ps1 kind = build_helper sizeBytes = 6767 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.ps1View on unpkg

Source & flagged code

3 flagged · loading source

bin/dsh-oc.cjsView file

3// dsh-oc aggregate installer: install every independent plugin in one command. L4: const { spawn, spawnSync } = require('node:child_process'); L5: const fs = require('node:fs'); ... L8: const readline = require('node:readline/promises'); L9: const { stdin, stdout } = require('node:process'); L10: ... L26: function profilePackageJson(profile) { L27: const home = process.env.DSH_HOME || path.join(os.homedir(), ".dsh"); L28: const p = path.join(home, "profiles", profile, "package.json"); L29: try { return JSON.parse(fs.readFileSync(p, "utf8")); } catch { return null; } L30: } ... L63: .map((a) => (/\s/.test(a) ? `"${a}"` : a)).join(" ");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/dsh-oc.cjsView on unpkg · L3

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/dsh-oc.cjsView on unpkg

install.ps1View file

Findings

2 High3 Medium4 Low

HighSandbox Evasion Gated Capabilitybin/dsh-oc.cjs

HighPrevious Version Dangerous Deltabin/dsh-oc.cjs

MediumEnvironment Vars

MediumShips Build Helperinstall.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to dsh-oc@0.3.21.

See all versions of dsh-oc for other recorded verdicts.

Review the evidence and your use of dsh-oc@0.3.21 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 11:50:27.596Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.