registry / Malware / dsh-win32 / 0.17.9

dsh-win32@0.17.9

Fix and diagnose DeepSeek Harness on native Windows. Official PowerShell, Workspace Write, shortcuts, and legacy preset repair. No WSL.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Source inspection confirms an unrequested, publisher-selected GitHub account action on the setup path. The CI skip and build-only lifecycle scripts do not prevent that runtime behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user runs the package's setup command outside CI.

Impact

The user's GitHub account is changed to star the publisher's repository without an affirmative consent step.

Mechanism

Setup calls a helper that checks for GitHub CLI authentication and, if available, submits a star request for the fixed publisher repository. A local marker prevents repeating the action.

Attack narrative

Running setup outside CI can silently use an existing GitHub CLI login to star the publisher's repository. The helper records a local marker, checks whether the CLI is authenticated, and submits the account action; the setup flow does not ask for affirmative consent to that action.

AI rationale

Source inspection confirms an unrequested, publisher-selected GitHub account action on the setup path. The CI skip and build-only lifecycle scripts do not prevent that runtime behavior.

Evidence

package.jsonbin/cli.mjsbin/setup-consent.mjs.dsh-win32-star-prompted

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package exposes bin/cli.mjs as its command-line entrypoint.
Running setup calls the GitHub-star helper in both current and legacy setup flows.
Outside CI, the helper proceeds without an affirmative user-consent check; it only skips in CI.
When GitHub CLI authentication is available, the helper sends a request to star the publisher's repository.
The helper also writes a local marker file before checking authentication.

Evidence against

The prepare script only runs the package build, and prepublishOnly runs the build and tests. This does not mitigate the runtime account action.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 135 KB of source, external domains: frippery.org, git-scm.com, github.com, learn.microsoft.com

Source & flagged code

7 flagged

bin/setup-consent.mjsView file

Lines 1-21javascript

1import { execFileSync } from 'node:child_process'

2import { existsSync, mkdirSync, writeFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/setup-consent.mjsView on unpkg · L1

3import { homedir } from 'node:os'

4import { join } from 'node:path'

5import process from 'node:process'

7const WIN = process.platform === 'win32'

8const DSH_HOME = process.env.DSH_HOME ?? join(homedir(), '.dsh')

9const REPO = 'https://github.com/sjh9714/dsh-win32'

11const CI_SETUP_ENV = [

12 'CI',

13 'GITHUB_ACTIONS',

14 'GITLAB_CI',

15 'BUILDKITE',

16 'CIRCLECI',

17 'JENKINS_URL',

18 'TEAMCITY_VERSION',

19 'TF_BUILD',

20]

bin/cli.mjsView file

Lines 1-62javascript

1#!/usr/bin/env node

2/**

3 * dsh-win32 CLI: `doctor` diagnoses the known DSH-on-Windows traps.

4 * Current `setup` verifies the official Windows stack and creates a shortcut.

5 * `setup --legacy` installs the old custom presets. Zero dependencies.

6 */

8import { execFileSync } from 'node:child_process'

9import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from

lib/verify.jsView file

Lines 118-158javascript

118 return undefined;

119 }

120}

121/** Locate only already-installed DSH trees. This never consults the registry. */

122export function findInstalledDsh(profile = 'web') {

123

lib/index.d.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/index.d.ts#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged · loading source

bin/setup-consent.mjsView file

1import { execFileSync } from 'node:child_process' L2: import { existsSync, mkdirSync, writeFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/setup-consent.mjsView on unpkg · L1

bin/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-win32@0.11.0 matchedIdentity = npm:ZHNoLXdpbjMy:0.11.0 similarity = 0.444 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.mjsView on unpkg

42if (process.env.ProgramFiles !== undefined) { L43: const candidate = join(process.env.ProgramFiles, 'PowerShell', '7', 'pwsh.exe') L44: if (existsSync(candidate)) return candidate

High

Shell

Package source references shell execution.

Findings

1 Critical5 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltabin/cli.mjs

HighChild Processbin/setup-consent.mjs

HighShellbin/cli.mjs

HighSame File Env Network Executionbin/cli.mjs

HighRuntime Package Installbin/cli.mjs

HighSemantic Analysis Limitedlib/index.d.ts#virtual:normalized:round1

MediumDynamic Requirelib/verify.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Low

Affected versions and remediation

This report applies to dsh-win32@0.17.9.

See all versions of dsh-win32 for other recorded verdicts.

Avoid installing dsh-win32@0.17.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-19 17:34:09.449Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages