dsh-oc@0.3.22
DeepSeek Harness 插件全家桶聚合安装器:一条命令装齐 壳/会话新窗口/深链/右侧工作台/逐轮产出物卡片/会话撤回(并为引擎补齐撤回所需 truncate 补丁;无功能代码,各功能为独立插件)
AI Security Review
scanned 20d ago · by lpm-firewall-aiSource supports explicit user-command modification of an AI-agent runtime, which the supplied policy classifies as warning-only capability risk. No concrete malicious behavior supports blocking publication.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running dsh-oc install or dsh-oc --install.
Impact
Changes agent runtime behavior and permits removal of session history through the added undo capability.
Mechanism
The CLI invokes a local patch helper that backs up and overwrites engine modules, enabling an API that rewrites stored session logs.
AI rationale
Source supports explicit user-command modification of an AI-agent runtime, which the supplied policy classifies as warning-only capability risk. No concrete malicious behavior supports blocking publication.
Evidence
bin/dsh-oc.cjsscripts/patch-engine-undo.cjspatches/dsh-host-apiproxy.patchpatches/dsh-session-persistence-jsonl.patch
Network endpoints2
registry.npmjs.org/npmmirror.com/mirrors/electron/
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest defines only a test script, with no automatic install lifecycle hook.
- The explicit CLI install command installs plugins and invokes engine patching.
- The patch helper backs up and overwrites installed DSH engine source files.
- The patches add a session truncation API and rewrite durable session logs.
Evidence against
- No credential harvesting, unrelated exfiltration, obfuscated payload, or covert execution was identified.
- Engine modification requires an explicit user command and implements session undo functionality.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcebin/dsh-oc.cjsView file
3// dsh-oc aggregate installer: install every independent plugin in one command.
L4: const { spawn, spawnSync } = require('node:child_process');
L5: const fs = require('node:fs');
...
L8: const readline = require('node:readline/promises');
L9: const { stdin, stdout } = require('node:process');
L10:
...
L26: function profilePackageJson(profile) {
L27: const home = process.env.DSH_HOME || path.join(os.homedir(), ".dsh");
L28: const p = path.join(home, "profiles", profile, "package.json");
L29: try { return JSON.parse(fs.readFileSync(p, "utf8")); } catch { return null; }
L30: }
...
L63: .map((a) => (/\s/.test(a) ? `"${a}"` : a)).join(" ");
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/dsh-oc.cjsView on unpkg · L3•matchType = previous_version_dangerous_delta
matchedPackage = dsh-oc@0.3.24
matchedIdentity = npm:ZHNoLW9j:0.3.24
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/dsh-oc.cjsView on unpkg271if (args[0] === "install" || args[0] === "--install") {
ensureDesktopStopped();
cleanupStaleInstall();
ensureEngine();
await detectLegacyConflicts(profile);
removeConflictingPlugins(profile);
ensureDesktopShell();
installPlugins(profile);
patchEngineUndo();
ensureShellShortcut(profile);
console.log(`[dsh-oc] all plugins installe
Findings
2 High6 Medium4 Low
HighSandbox Evasion Gated Capabilitybin/dsh-oc.cjs
HighPrevious Version Dangerous Deltabin/dsh-oc.cjs
MediumEnvironment Vars
MediumShips Build Helperinstall.ps1
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencebin/dsh-oc.cjs
MediumAi Review Evidencescripts/patch-engine-undo.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dsh-oc@0.3.22.
See all versions of dsh-oc for other recorded verdicts.
- Review the evidence and your use of dsh-oc@0.3.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.