dsh-oc@0.3.43
⚠ Under reviewDeepSeek Harness 插件全家桶聚合安装器:一条命令装齐 壳/会话新窗口/深链/右侧工作台/逐轮产出物卡片/会话撤回(并为引擎补齐撤回所需 truncate 补丁;无功能代码,各功能为独立插件)
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourcebin/dsh-oc.cjsView file
3// dsh-oc aggregate installer: install every independent plugin in one command.
L4: const { spawn, spawnSync } = require('node:child_process');
L5: const fs = require('node:fs');
...
L8: const readline = require('node:readline/promises');
L9: const { stdin, stdout } = require('node:process');
L10:
...
L26: function profilePackageJson(profile) {
L27: const home = process.env.DSH_HOME || path.join(os.homedir(), ".dsh");
L28: const p = path.join(home, "profiles", profile, "package.json");
L29: try { return JSON.parse(fs.readFileSync(p, "utf8")); } catch { return null; }
L30: }
...
L63: .map((a) => (/\s/.test(a) ? `"${a}"` : a)).join(" ");
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/dsh-oc.cjsView on unpkg · L3•matchType = previous_version_dangerous_delta
matchedPackage = dsh-oc@0.3.25
matchedIdentity = npm:ZHNoLW9j:0.3.25
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/dsh-oc.cjsView on unpkginstall.ps1View file
Findings
2 High3 Medium4 Low
HighSandbox Evasion Gated Capabilitybin/dsh-oc.cjs
HighPrevious Version Dangerous Deltabin/dsh-oc.cjs
MediumEnvironment Vars
MediumShips Build Helperinstall.ps1
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dsh-oc@0.3.43.
See all versions of dsh-oc for other recorded verdicts.
- Review the evidence and your use of dsh-oc@0.3.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.