registry / Malware / dsh-win32 / 0.17.14

dsh-win32@0.17.14

Fix and diagnose DeepSeek Harness on native Windows. Official PowerShell, Workspace Write, shortcuts, and legacy preset repair. No WSL.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The source establishes an unrequested, publisher-selected authenticated account action during setup, which is concrete attack behavior. The manifest’s lifecycle scripts only build and test, but that does not prevent the runtime setup path from changing the user’s GitHub account.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs current or legacy setup outside a detected CI environment while GitHub CLI authentication is available.

Impact

The user’s GitHub account is changed by an action unrelated to the requested local setup.

Mechanism

The setup helper checks GitHub CLI authentication, then sends a PUT request to GitHub’s repository-star endpoint. Its marker records a yes answer without obtaining one.

Attack narrative

Running setup can trigger a GitHub star for the publisher’s repository through the user’s authenticated GitHub CLI account. The helper records a yes marker without prompting; CI detection is the only inspected skip guard.

AI rationale

Evidence

bin/cli.mjsbin/setup-consent.mjs.dsh-win32-star-prompted

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

The package exposes a setup command, and its prepare and prepublishOnly scripts run build and test tasks.
Both current and legacy setup call the GitHub star helper without an affirmative prompt.
When an authenticated GitHub CLI account is available, the helper sends a PUT request to star the publisher’s repository; CI setup skips this action.

Evidence against

The manifest has no preinstall, install, or postinstall hook.
The account action is limited to setup flows and is skipped in CI.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 152 KB of source, external domains: frippery.org, git-scm.com, github.com, learn.microsoft.com

Source & flagged code

7 flagged

bin/setup-consent.mjsView file

Lines 1-21javascript

1import { execFileSync } from 'node:child_process'

2import { existsSync, mkdirSync, writeFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/setup-consent.mjsView on unpkg · L1

3import { homedir } from 'node:os'

4import { join } from 'node:path'

5import process from 'node:process'

7const WIN = process.platform === 'win32'

8const DSH_HOME = process.env.DSH_HOME ?? join(homedir(), '.dsh')

9const REPO = 'https://github.com/sjh9714/dsh-win32'

11const CI_SETUP_ENV = [

12 'CI',

13 'GITHUB_ACTIONS',

14 'GITLAB_CI',

15 'BUILDKITE',

16 'CIRCLECI',

17 'JENKINS_URL',

18 'TEAMCITY_VERSION',

19 'TF_BUILD',

20]

bin/cli.mjsView file

Lines 1-64javascript

1#!/usr/bin/env node

2/**

3 * dsh-win32 CLI: `doctor` diagnoses the known DSH-on-Windows traps.

4 * Current `setup` verifies the official Windows stack and creates a shortcut.

5 * `setup --legacy` installs the old custom presets.

6 */

8import { execFileSync } from 'node:child_process'

9import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from

lib/verify.jsView file

Lines 118-158javascript

118 return undefined;

119 }

120}

121/** Locate only already-installed DSH trees. This never consults the registry. */

122export function findInstalledDsh(profile = 'web') {

123

lib/index.d.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/index.d.ts#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged · loading source

bin/setup-consent.mjsView file

1import { execFileSync } from 'node:child_process' L2: import { existsSync, mkdirSync, writeFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/setup-consent.mjsView on unpkg · L1

bin/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-win32@0.11.0 matchedIdentity = npm:ZHNoLXdpbjMy:0.11.0 similarity = 0.444 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.mjsView on unpkg

44if (process.env.ProgramFiles !== undefined) { L45: const candidate = join(process.env.ProgramFiles, 'PowerShell', '7', 'pwsh.exe') L46: if (existsSync(candidate)) return candidate

High

Shell

Package source references shell execution.

Findings

1 Critical5 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltabin/cli.mjs

HighChild Processbin/setup-consent.mjs

HighShellbin/cli.mjs

HighSame File Env Network Executionbin/cli.mjs

HighRuntime Package Installbin/cli.mjs

HighSemantic Analysis Limitedlib/index.d.ts#virtual:normalized:round1

MediumDynamic Requirelib/verify.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Low

Affected versions and remediation

This report applies to dsh-win32@0.17.14.

See all versions of dsh-win32 for other recorded verdicts.

Avoid installing dsh-win32@0.17.14. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-19 17:34:44.044Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages