registry / dsh-remote / 0.8.70
dsh-remote@0.8.70
⚠ Under reviewRemote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive, multi-hop ProxyJump), list hosts from ~/.ssh/config, pick a remote workspace, operate on it with 21 rw_* tools, conflict-aware mirror sync, an embedded PTY t
Static Scan Results
scanned 2d ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedlib/client.jsView file
27L28: const React = require('react')
L29: const name = 'dsh-remote'
Medium
Dynamic Require
Package source references dynamic require/import behavior.
lib/client.jsView on unpkg · L27node_modules/ssh2/lib/protocol/keyParser.jsView file
1// TODO:
L2: // * utilize `crypto.create(Private|Public)Key()` and `keyObject.export()`
L3: // * handle multi-line header values (OpenSSH)?
...
L7: const {
L8: createDecipheriv,
L9: createECDH,
...
L1017: // m[3] = comment
L1018: // m[4] = base64-encoded public key data:
L1019: // for "ssh-rsa":
Low
Weak Crypto
Package source references weak cryptographic algorithms.
node_modules/ssh2/lib/protocol/keyParser.jsView on unpkg · L1lib/update.jsView file
Findings
1 Critical3 High6 Medium5 Low
CriticalManifest Confusionpackage.json
HighEntrypoint Foreign Package Code Overwritelib/update.js
HighSemantic Analysis Limitedcordis.patch.yml
HighPrevious Version Dangerous Deltalib/index.js
MediumDynamic Requirelib/client.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarynode_modules/ssh2/util/pagent.exe
MediumShips Build Helpernode_modules/ssh2/util/build_pagent.bat
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptonode_modules/ssh2/lib/protocol/keyParser.js
LowFilesystem
Affected versions and remediation
This report applies to dsh-remote@0.8.70.
See all versions of dsh-remote for other recorded verdicts.
- Review the evidence and your use of dsh-remote@0.8.70 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.