dsh-win32@0.13.2

⚠ Under review

在 Windows 上把 DSH 用起来。一行装好极简模式的持久 shell，沙箱内也能用 | Get DSH working on Windows: persistent shell for Minimal mode, sandbox included

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 78.0 KB of source, external domains: frippery.org, git-scm.com, github.com

Source & flagged code

7 flagged

bin/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-win32@0.11.0 matchedIdentity = npm:ZHNoLXdpbjMy:0.11.0 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.mjsView on unpkg

7L8: import { execFileSync } from 'node:child_process' L9: import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/cli.mjsView on unpkg · L7

40if (process.env.ProgramFiles !== undefined) { L41: const candidate = join(process.env.ProgramFiles, 'PowerShell', '7', 'pwsh.exe') L42: if (existsSync(candidate)) return candidate

High

Shell

Package source references shell execution.

bin/cli.mjsView on unpkg · L40

7L8: import { execFileSync } from 'node:child_process' L9: import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs' ... L17: const WIN = process.platform === 'win32' L18: const DSH_HOME = process.env.DSH_HOME ?? join(homedir(), '.dsh') L19: const PRESET_ID = 'minimal-windows' L20: const PRESET_SRC = join(dirname(fileURLToPath(import.meta.url)), '..', 'preset', PRESET_ID) L21: const REPO = 'https://github.com/sjh9714/dsh-win32' L22: const SELF_VERSION = JSON.parse(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.mjsView on unpkg · L7

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/cli.mjs: import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs' const REPO = 'https://github.com/sjh9714/dsh-win32' const manifest = join(profilesDir, profile, 'node_modules', 'koffi', 'package.json') add('dsh-win32/bundle', 'warn', 'listed in the profile manifest but absent from its node_modules, so the runtime never loads; run: npx dsh-win32 setup') if (gitBash === undefined) add('git_bash', 'fail', 'Git Bash not found. Install from https://git-scm.com (winget install Git.Git), then re-run') const installed = join(DSH_HOME, 'profiles', profile, 'node_modules', 'dsh-win32', 'package.json') const

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/cli.mjsView on unpkg

147} else if (wiredBundle === 'wired, not installed') { L148: add('dsh-win32/bundle', 'warn', 'listed in the profile manifest but absent from its node_modules, so the runtime never loads; run: npx dsh-win32 setup') L149: } else if (wiredBundle === 'unreadable') { ... L162: if (!WIN) { L163: for (const name of ['git_bash', 'powershell', 'koffi', 'sandbox_shell', 'write_fence']) add(name, 'skip', NOT_WINDOWS) L164: return { checks, gitBash }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.mjsView on unpkg · L147

lib/console-list.jsView file

64function nodePtyUtils() { L65: const here = createRequire(import.meta.url); L66: const bases = [here];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/console-list.jsView on unpkg · L64

Source & flagged code

7 flagged · loading source

bin/cli.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.mjsView on unpkg

7L8: import { execFileSync } from 'node:child_process' L9: import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/cli.mjsView on unpkg · L7

40if (process.env.ProgramFiles !== undefined) { L41: const candidate = join(process.env.ProgramFiles, 'PowerShell', '7', 'pwsh.exe') L42: if (existsSync(candidate)) return candidate

High

Shell

Package source references shell execution.

bin/cli.mjsView on unpkg · L40

Findings

1 Critical5 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltabin/cli.mjs

HighChild Processbin/cli.mjs

HighShellbin/cli.mjs

HighSame File Env Network Executionbin/cli.mjs

HighEntrypoint Foreign Package Code Overwritebin/cli.mjs

HighRuntime Package Installbin/cli.mjs

MediumDynamic Requirelib/console-list.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to dsh-win32@0.13.2.

See all versions of dsh-win32 for other recorded verdicts.

Review the evidence and your use of dsh-win32@0.13.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-17 17:15:34.937Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.