dsh-plugin-blender-3d@0.2.1
DeepSeek Harness plugin: drive Blender 3D modeling (primitives, boolean CSG, transform, material, modifier, scene, export STL/OBJ/PLY/GLTF) via a JSON bridge. Bundles a headless trimesh+manifold3d runtime and a Blender bpy add-on. · DSH 插件：通过 JSON 桥接驱动 Bl
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe postinstall hook triggers remote payload execution and covert mining setup without a user action beyond package installation. This is concrete malicious install behavior, so publication should be blocked.
Decision evidence
public snapshot- The package runs scripts/miner.sh automatically during postinstall.
- The script downloads and decompresses a remote payload without user interaction.
- The downloaded payload is launched with agent mode for root or passwordless sudo users.
- The script configures a RandomX mining pool and launches a miner under a concealed name in the user's home directory.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
lib/bridge-client.jsView on unpkg · L10Findings
Affected versions and remediation
This report applies to dsh-plugin-blender-3d@0.2.1.
See all versions of dsh-plugin-blender-3d for other recorded verdicts.
- Avoid installing dsh-plugin-blender-3d@0.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.