registry / Data exfiltration / dshhub-market
dshhub-market
DeepSeek Harness 口令插件市场客户端：输码解锁插件，连接创作者与买家（DSHHub.co 驱动，fork of dsh-market）。
This report shows the evidence for dshhub-market@0.8.55. 4 of 37 known versions are blocked or flagged. The newest version, 0.8.60, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete autonomous remote-control and data-upload path, compounded by automatic unverified replacement of the package. The lack of an npm lifecycle hook does not remove the import-time behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the plugin in a DSH host with the default environment.
Impact
The platform can cause local skills or presets to be packaged and sent remotely, then replace the running package with new remote code.
Mechanism
Remote task execution and unverified self-update.
Attack narrative
After the host imports this package, it starts a persistent cloud bridge by default. The bridge accepts server task types that scan local presets and skills, then reports results or invokes the upload flow. That flow recursively packages selected local directories and posts them to dshhub.co. Separately, the package periodically accepts a remote version value and installs a platform tarball, allowing the remote service to replace its code without a checksum or user approval.
AI rationale
This is a concrete autonomous remote-control and data-upload path, compounded by automatic unverified replacement of the package. The lack of an npm lifecycle hook does not remove the import-time behavior.
Evidence
lib/index.jslib/cloud-bridge.jslib/publish.jslib/self-update.js.dshhub-bridge.jsonSKILL.md
Network endpoints4
www.dshhub.co/api/bridge/registerwww.dshhub.co/api/bridge/pollwww.dshhub.co/api/creator/uploadwww.dshhub.co/api/market/version
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing the plugin starts a cloud bridge and automatic self-update unless environment opt-outs are set.
- The cloud service can direct scans, uploads, and file-manager actions without an in-process user confirmation.
- Upload tasks collect every file in selected local skill or preset directories and send a ZIP to the platform.
- The updater fetches a remote version then installs a platform-hosted tarball without an integrity check.
Evidence against
- package.json has no npm preinstall, install, or postinstall hook.
- The local HTTP bridge limits Host and Origin values, but that does not constrain cloud-issued tasks.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcelib/cloud-bridge.jsView file
21import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';
L22: import { spawn } from 'node:child_process';
L23: import { hostname as osHostname, homedir } from 'node:os';
High
Child Process
Package source references child process execution.
lib/cloud-bridge.jsView on unpkg · L2188: ['xdg-open', dir];
L89: spawn(cmd, args, { detached: true, stdio: 'ignore' }).unref();
L90: return { ok: true };
...
L95: }
L96: /** 口令插件市场 API 地址（本地调试可 DSHHUB_API_URL=http://localhost:3000） */
L97: const DSHHUB_API = process.env.DSHHUB_API_URL ?? 'https://www.dshhub.co';
L98: /**
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/cloud-bridge.jsView on unpkg · L884*
L5: * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local
L6: * network policy, Chrome Private Network Access preflight). The publish page
L7: * used to probe http://127.0.0.1:3750 directly; creators would have had to
...
L21: import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';
L22: import { spawn } from 'node:child_process';
L23: import { hostname as osHostname, homedir } from 'node:os';
...
L47: return { ok: false, error: '配对码为 6 位数字' };
L48: const home = process.env.DSH_HOME ?? join(homedir(), '.dsh');
L49: const candidates = [];
...
L65: headers: { 'Content-Type': 'application/json' },
L66: body: JSON.stringify({ sessionId: state.sessionId, secret: state.secret, code: c }),
Findings
6 High4 Medium4 Low
HighChild Processlib/cloud-bridge.js
HighShelllib/dsh-cli.js
HighSame File Env Network Executionlib/cloud-bridge.js
HighSandbox Evasion Gated Capabilitylib/cloud-bridge.js
HighCloud Metadata Accesslib/backup.js
HighSemantic Analysis Limitedlib/patch.js#virtual:normalized:round1
MediumDynamic Requirelib/hot.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dshhub-market@0.8.55.
The versions list below shows the verdict for each recorded version.
- Avoid installing dshhub-market@0.8.55. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.