registry / dshhub-market / 0.8.30

dshhub-market@0.8.30

DeepSeek Harness 口令插件市场客户端：输码解锁插件，连接创作者与买家（DSHHub.co 驱动，fork of dsh-market）。

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 1.81 MB of source, external domains: 127.0.0.1, api.github.com, app.koofr.net, dav.example.com, dav.jianguoyun.com, get.pnpm.io, gist.github.com, github.com, nextcloud.example, nodejs.org, player.bilibili.com, raw.githubusercontent.com, registry.npmjs.org, www.dshhub.co, www.w3.org, www.youtube.com

Source & flagged code

4 flagged

lib/hot.jsView file

Lines 39-79javascript

39const HOT_MOUNT_TIMEOUT_MS = Number(process.env.DSH_MARKET_HOT_MOUNT_TIMEOUT_MS) || 10000;

40let hotTreeClass;

41/**

42 * The Include subclass, built once per process; null when the loader's include

43 * plugin is not importable (older harness) — callers fall back to restart.

44 */

45/**

46 * Packages whose host import is replaced by a no-op shim. Client-only plugins

47 * (`dsh.client` without `dsh.bundle`) have no importable host half, but

48 * client-modules only serves bundles for packages with a live loader entry —

49 * the shim fiber exists purely to satisfy that registration.

50 */

51const shimNames = new Set();

52async function loadHotTreeClass() {

53 if (hotTreeClass !== undefined)

54 return hotTreeClass;

55 try {

56 // Computed specifier: the include plugin ships with the harness (vendored,

57 // unpublished), so it resolves at runtime through the profile fallback but

58 // is not typecheckable as a dependency.

59 const specifier = '@deepseek-ai/cordis-plugin-include';

60 const mod = (await import(__rewriteRelativeImportExtension(specifier)));

61 const Include = mod.Include;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/hot.jsView on unpkg · L59

62 if (Include === undefined)

63 throw new Error('no Include export');

64 class MarketHotTree extends Include {

65 /** Runtime-only mount list; the bundle layer owns persistence. */

66 write() { }

67 import(name, getOuterStack) {

68 if (shimNames.has(name))

69 return { name, apply: () => { } };

70 return super.import(name, getOuterStack);

71 }

72 }

73 hotTreeClass = MarketHotTree;

74 }

75 catch {

76 hotTreeClass = null;

77 }

78 return hotTreeClass;

79}

lib/app-runtime.jsView file

Lines 1-38javascript

1/**

2 * Deployable app runtime (kind=app): picks a random free 127.0.0.1 port,

3 * runs the manifest `build` once per installed version, spawns the `start`

4 * command as a detached process group, and tracks liveness in

5 * <apps-root>/.dshhub/runtime.json.

6 *

7 * Spawn discipline mirrors dsh-cli.ts (the market's first spawn point):

8 * detached process group → killTree (SIGTERM → 5s SIGKILL; Windows

9 * taskkill /T /F). Apps never run with elevated rights, never outside

10 * their own <apps-root>/<name>/ directory, and only listen on 127.0.0.1.

lib/backup.jsView file

Lines 1-23javascript

1/**

2 * Portable profile backups: configuration only, never installed packages.

3 *

4 * The profile directory is plain user data — aside from package.json it can

5 * hold API keys (config.toml), tokens, or the WebDAV password when stored

6 * server-side. Backups therefore behave like `dsh export` and carry the same

7 * credential-warning disclaimer in the UI (review #63).

8 */

9import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'

src/client/MarketSection.tsxView file

•matchType = previous_version_dangerous_delta matchedPackage = dshhub-market@0.8.28 matchedIdentity = npm:ZHNoaHViLW1hcmtldA:0.8.28 similarity = 0.947 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/client/MarketSection.tsxView on unpkg

Source & flagged code

4 flagged · loading source

lib/hot.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code