dshhub-market@0.8.4

DeepSeek Harness 口令插件市场客户端：输码解锁插件，连接创作者与买家（DSHHub.co 驱动，fork of dsh-market）。

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 77 file(s), 1.52 MB of source, external domains: 127.0.0.1, api.github.com, app.koofr.net, dav.example.com, dav.jianguoyun.com, get.pnpm.io, gist.github.com, github.com, nextcloud.example, player.bilibili.com, raw.githubusercontent.com, registry.npmjs.org, www.dshhub.co, www.w3.org, www.youtube.com

Source & flagged code

3 flagged

lib/hot.jsView file

Lines 39-79javascript

39const HOT_MOUNT_TIMEOUT_MS = Number(process.env.DSH_MARKET_HOT_MOUNT_TIMEOUT_MS) || 10000;

40let hotTreeClass;

41/**

42 * The Include subclass, built once per process; null when the loader's include

43 * plugin is not importable (older harness) — callers fall back to restart.

44 */

45/**

46 * Packages whose host import is replaced by a no-op shim. Client-only plugins

47 * (`dsh.client` without `dsh.bundle`) have no importable host half, but

48 * client-modules only serves bundles for packages with a live loader entry —

49 * the shim fiber exists purely to satisfy that registration.

50 */

51const shimNames = new Set();

52async function loadHotTreeClass() {

53 if (hotTreeClass !== undefined)

54 return hotTreeClass;

55 try {

56 // Computed specifier: the include plugin ships with the harness (vendored,

57 // unpublished), so it resolves at runtime through the profile fallback but

58 // is not typecheckable as a dependency.

59 const specifier = '@deepseek-ai/cordis-plugin-include';

60 const mod = (await import(__rewriteRelativeImportExtension(specifier)));

61 const Include = mod.Include;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/hot.jsView on unpkg · L59

62 if (Include === undefined)

63 throw new Error('no Include export');

64 class MarketHotTree extends Include {

65 /** Runtime-only mount list; the bundle layer owns persistence. */

66 write() { }

67 import(name, getOuterStack) {

68 if (shimNames.has(name))

69 return { name, apply: () => { } };

70 return super.import(name, getOuterStack);

71 }

72 }

73 hotTreeClass = MarketHotTree;

74 }

75 catch {

76 hotTreeClass = null;

77 }

78 return hotTreeClass;

79}

lib/backup.jsView file

Lines 1-23javascript

1/**

2 * Portable profile backups: configuration only, never installed packages.

3 *

4 * The profile directory is plain user data — aside from package.json it can

5 * hold API keys (config.toml), tokens, or the WebDAV password when stored

6 * server-side. Backups therefore behave like `dsh export` and carry the same

7 * credential-warning disclaimer in the UI (review #63).

8 */

9import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'

src/client/MarketSection.tsxView file

•matchType = previous_version_dangerous_delta matchedPackage = dshhub-market@0.8.1 matchedIdentity = npm:ZHNoaHViLW1hcmtldA:0.8.1 similarity = 0.961 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/client/MarketSection.tsxView on unpkg

Source & flagged code

3 flagged · loading source

lib/hot.jsView file

59const specifier = '@deepseek-ai/cordis-plugin-include'; L60: const mod = (await import(__rewriteRelativeImportExtension(specifier))); L61: const Include = mod.Include;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/hot.jsView on unpkg · L59

lib/backup.jsView file

3* L4: * The profile directory is plain user data — aside from package.json it can L5: * hold API keys (config.toml), tokens, or the WebDAV password when stored ... L9: import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'; L10: import { lookup } from 'node:dns/promises'; L11: import { request as httpsRequest } from 'node:https'; ... L58: throw new Error('profile package.json is missing'); L59: const manifest = JSON.parse(readFileSync(manifestFile, 'utf8')); L60: if (opts?.includeDeps !== undefined) { ... L265: }); L266: response.once('end', () => resolveRequest({ status: response.statusCode ?? 0, body: Buffer.concat(chunks) })); L267: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/backup.jsView on unpkg · L3

Findings

2 High4 Medium4 Low

HighCloud Metadata Accesslib/backup.js

HighPrevious Version Dangerous Deltasrc/client/MarketSection.tsx

MediumDynamic Requirelib/hot.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to dshhub-market@0.8.4.

See all versions of dshhub-market for other recorded verdicts.

Review the evidence and your use of dshhub-market@0.8.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-21 16:36:24.064Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.