dsh-win32@0.17.15
Fix and diagnose DeepSeek Harness on native Windows. Official PowerShell, Workspace Write, shortcuts, and legacy preset repair. No WSL.
AI Security Review
scanned 6h ago · by lpm-firewall-aiSetup performs an account change to a publisher-selected repository without recipient-specific consent. This supports blocking based on the verified unrequested account action, even though the npm prepare hook itself only builds the package.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user runs the CLI setup command outside CI with an authenticated GitHub CLI account and no existing marker.
Impact
An unrequested change is made to the user’s GitHub account by adding a repository star.
Mechanism
Setup calls a helper that checks GitHub CLI authentication and sends a PUT request to star the publisher’s repository. It records a local marker, but does not obtain the user’s confirmation.
Attack narrative
When setup runs outside CI, it checks whether the GitHub CLI is authenticated and, if so, stars the publisher’s repository with that account. The helper records a local marker but does not ask the user before making the account change. The npm prepare hook only runs a build; this behavior is activated by the CLI setup command.
AI rationale
Setup performs an account change to a publisher-selected repository without recipient-specific consent. This supports blocking based on the verified unrequested account action, even though the npm prepare hook itself only builds the package.
Evidence
bin/cli.mjsbin/setup-consent.mjspackage.json.dsh-win32-star-prompted
Network endpoints1
github.com
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Running the CLI setup command reaches setup logic.
- Both current and legacy setup paths invoke the star helper without an explicit confirmation step.
- The helper checks for an authenticated GitHub CLI account, then sends a PUT request to star the publisher’s repository.
- The helper writes a local marker containing “yes” before making the account change; that value is not gathered from the user.
- The CI guard skips the action in CI, but ordinary setup has no equivalent consent guard.
- The npm prepare hook runs a build; the account change is tied to CLI setup.
Evidence against
- The request uses GitHub’s CLI and targets the package’s own repository; no credential is copied to another destination.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcebin/setup-consent.mjsView file
1import { execFileSync } from 'node:child_process'
L2: import { existsSync, mkdirSync, writeFileSync } from 'node:fs'
High
Child Process
Package source references child process execution.
bin/setup-consent.mjsView on unpkg · L1•matchType = normalized_sha256
matchedPackage = dsh-win32@0.17.12
matchedPath = bin/setup-consent.mjs
matchedIdentity = npm:ZHNoLXdpbjMy:0.17.12
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/setup-consent.mjsView on unpkgbin/cli.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = dsh-win32@0.17.4
matchedIdentity = npm:ZHNoLXdpbjMy:0.17.4
similarity = 0.625
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Findings
1 Critical7 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltabin/cli.mjs
HighChild Processbin/setup-consent.mjs
HighShellbin/cli.mjs
HighSame File Env Network Executionbin/cli.mjs
HighRuntime Package Installbin/cli.mjs
HighSemantic Analysis Limitedlib/index.d.ts#virtual:normalized:round1
HighKnown Malware Source Similaritybin/cli.mjs
HighKnown Malware Source Similaritybin/setup-consent.mjs
MediumDynamic Requirelib/verify.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to dsh-win32@0.17.15.
See all versions of dsh-win32 for other recorded verdicts.
- Avoid installing dsh-win32@0.17.15. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.