registry / dsh-win32 / 0.4.0

dsh-win32@0.4.0

First-class Windows for DeepSeek Harness: real persistent-bash Minimal mode (Git Bash PTY), a doctor for the known install traps, one-command setup | 让 DeepSeek Harness 在 Windows 上成为一等公民

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 21.9 KB of source, external domains: frippery.org, git-scm.com

Source & flagged code

3 flagged

bin/cli.mjsView file

7L8: import { execFileSync } from 'node:child_process' L9: import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/cli.mjsView on unpkg · L7

52if (process.env.ProgramFiles !== undefined) { L53: const candidate = join(process.env.ProgramFiles, 'PowerShell', '7', 'pwsh.exe') L54: if (existsSync(candidate)) return candidate

High

Shell

Package source references shell execution.

bin/cli.mjsView on unpkg · L52

90const pwsh7 = findPwsh7() L91: if (pwsh7 !== undefined) ok(`PowerShell 7: ${pwsh7}`) L92: else warn('PowerShell 7 not found — the Windows 5.1 fallback crashes (0xC0000142) inside the DSH sandbox; winget install Microsoft.PowerShell') ... L96: warn(`koffi ${version} in profile "${profile}" — broken win32-x64 prebuilt (install failures, folder-picker and session-save crashes)`) L97: info(`fix: cd "${join(DSH_HOME, 'profiles', profile)}" && pnpm add koffi@3.1.2 --ignore-scripts`) L98: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.mjsView on unpkg · L90

Source & flagged code

3 flagged · loading source

bin/cli.mjsView file

7L8: import { execFileSync } from 'node:child_process' L9: import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/cli.mjsView on unpkg · L7

52if (process.env.ProgramFiles !== undefined) { L53: const candidate = join(process.env.ProgramFiles, 'PowerShell', '7', 'pwsh.exe') L54: if (existsSync(candidate)) return candidate

High

Shell

Package source references shell execution.

bin/cli.mjsView on unpkg · L52

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.mjsView on unpkg · L90

Findings

3 High3 Medium5 Low

HighChild Processbin/cli.mjs

HighShellbin/cli.mjs

HighRuntime Package Installbin/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to dsh-win32@0.4.0.

See all versions of dsh-win32 for other recorded verdicts.

Review the evidence and your use of dsh-win32@0.4.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-15 10:10:01.155Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.