registry / dshhub-market / 0.8.0
dshhub-market@0.8.0
⚠ Under reviewDeepSeek Harness 口令插件市场客户端：输码解锁插件，连接创作者与买家（DSHHub.co 驱动，fork of dsh-market）。
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 20 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcelib/hot.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = dshhub-market@0.8.58
matchedIdentity = npm:ZHNoaHViLW1hcmtldA:0.8.58
similarity = 0.772
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/hot.jsView on unpkg59const specifier = '@deepseek-ai/cordis-plugin-include';
L60: const mod = (await import(__rewriteRelativeImportExtension(specifier)));
L61: const Include = mod.Include;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
lib/hot.jsView on unpkg · L59lib/backup.jsView file
3*
L4: * The profile directory is plain user data — aside from package.json it can
L5: * hold API keys (config.toml), tokens, or the WebDAV password when stored
...
L9: import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
L10: import { lookup } from 'node:dns/promises';
L11: import { request as httpsRequest } from 'node:https';
...
L58: throw new Error('profile package.json is missing');
L59: const manifest = JSON.parse(readFileSync(manifestFile, 'utf8'));
L60: if (opts?.includeDeps !== undefined) {
...
L265: });
L266: response.once('end', () => resolveRequest({ status: response.statusCode ?? 0, body: Buffer.concat(chunks) }));
L267: });
Findings
11 High4 Medium5 Low
HighCloud Metadata Accesslib/backup.js
HighSemantic Analysis Limitedlib/patch.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/restart.js
HighKnown Malware Source Similaritysrc/restart.ts
HighKnown Malware Source Similaritylib/gist.js
HighKnown Malware Source Similaritysrc/gist.ts
HighKnown Malware Source Similaritylib/sources.js
HighKnown Malware Source Similaritylib/updates.js
HighKnown Malware Source Similaritysrc/sources.ts
HighKnown Malware Source Similaritysrc/updates.ts
HighPrevious Version Dangerous Deltalib/hot.js
MediumDynamic Require
Affected versions and remediation
This report applies to dshhub-market@0.8.0.
See all versions of dshhub-market for other recorded verdicts.
- Review the evidence and your use of dshhub-market@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.