registry / dsh-remote / 0.3.3
dsh-remote@0.3.3
Remote-work assistant for DeepSeek Harness: connect SSH (password or key), pick a remote workspace, operate on it with rw_pick_workspace / rw_list_dir / rw_read_file / rw_exec / rw_sync tools, and mirror it to a real local directory (SFTP) so the DSH nati
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 4 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
1 flaggedlib/index.jsView file
3// Host half. Turns "give me a remote host + login" into a usable REMOTE WORKSPACE:
L4: // • one persistent SSH/SFTP pool per configured remote (password OR private key),
L5: // • a "current remote workspace" — a remote directory the agent treats as the
...
L106: const tag = [host, user, port].filter(Boolean).join('-').replace(/[^a-zA-Z0-9._-]/g, '_')
L107: return path.join(homedir(), '.dsh', 'remote-workspaces', tag)
L108: }
...
L281:
L282: /** Run one remote command; resolves { code, signal, stdout, stderr }. */
L283: exec(command, timeoutMs) {
L284: return this.connect().then(
...
L361: try {
L362: client.end()
Low
Findings
1 Medium3 Low
MediumNetwork
LowWeak Cryptolib/index.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to dsh-remote@0.3.3.
See all versions of dsh-remote for other recorded verdicts.
- Review the evidence and your use of dsh-remote@0.3.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.