Loading npm security reports…

dshhub-market@0.8.50: Malicious npm security report (Block) | LPM Firewall

registry / dshhub-market / 0.8.50

dshhub-market@0.8.50

DeepSeek Harness 口令插件市场客户端：输码解锁插件，连接创作者与买家（DSHHub.co 驱动，fork of dsh-market）。

AI Security Review

scanned 3h ago · by lpm-firewall-ai

On host startup, the package opens a persistent vendor-controlled task channel. The service can request local skill or preset scans and uploads, and it can cause installation of a remote replacement tarball.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Loading the plugin in a DSH host with the opt-out environment variables unset.

Impact

A remote service can obtain locally stored agent skills or presets and replace the installed package without a per-action user confirmation.

Mechanism

Automatic remote task polling, local archive upload, and remote tarball self-update.

Attack narrative

When the plugin is loaded, it starts a cloud bridge by default. The bridge polls the vendor and accepts upload tasks that select names from local skill or preset scans. The upload path recursively reads the selected directory, creates a zip archive, and sends it to the vendor service. Independently, the package polls for a newer version and installs a remote tarball into the active profile. These actions occur without a local confirmation for each scan, upload, or update.

Rationale

This is an automatically activated remote-control and data-upload channel, coupled with unauthenticated-by-source remote replacement of the package. The absence of an npm lifecycle hook does not remove the runtime attack surface.

Evidence

lib/index.jslib/cloud-bridge.jslib/bridge.jslib/publish.jslib/self-update.js.dshhub-bridge.jsonpresetsskills

Network endpoints

Source & flagged code

8 flagged · loading source

lib/cloud-bridge.jsView file

21import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs'; L22: import { spawn } from 'node:child_process'; L23: import { hostname as osHostname, homedir } from 'node:os';

High

Child Process

Package source references child process execution.

lib/cloud-bridge.jsView on unpkg · L21

78: ['xdg-open', dir]; L79: spawn(cmd, args, { detached: true, stdio: 'ignore' }).unref(); L80: return { ok: true }; ... L85: } L86: /** 口令插件市场 API 地址（本地调试可 DSHHUB_API_URL=http://localhost:3000） */ L87: const DSHHUB_API = process.env.DSHHUB_API_URL ?? 'https://www.dshhub.co'; L88: /**

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/cloud-bridge.jsView on unpkg · L78

4* L5: * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local L6: * network policy, Chrome Private Network Access preflight). The publish page L7: * used to probe http://127.0.0.1:3750 directly; creators would have had to ... L21: import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs'; L22: import { spawn } from 'node:child_process'; L23: import { hostname as osHostname, homedir } from 'node:os'; ... L37: return { ok: false, error: '配对码为 6 位数字' }; L38: const home = process.env.DSH_HOME ?? join(homedir(), '.dsh'); L39: const candidates = []; ... L55: headers: { 'Content-Type': 'application/json' }, L56: body: JSON.stringify({ sessionId: state.sessionId, secret: state.secret, code: c }),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/cloud-bridge.jsView on unpkg · L4

lib/dsh-cli.jsView file

80export const winCmdShim = process.platform === 'win32'; L81: /** Characters cmd.exe treats as syntax even inside a token. */ L82: const CMD_METACHARS = /[\s"&|<>^()%!]/;

High

Shell

Package source references shell execution.

lib/dsh-cli.jsView on unpkg · L80

lib/hot.jsView file

59const specifier = '@deepseek-ai/cordis-plugin-include'; L60: const mod = (await import(__rewriteRelativeImportExtension(specifier))); L61: const Include = mod.Include;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/hot.jsView on unpkg · L59

lib/backup.jsView file

3* L4: * The profile directory is plain user data — aside from package.json it can L5: * hold API keys (config.toml), tokens, or the WebDAV password when stored ... L9: import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'; L10: import { lookup } from 'node:dns/promises'; L11: import { request as httpsRequest } from 'node:https'; ... L58: throw new Error('profile package.json is missing'); L59: const manifest = JSON.parse(readFileSync(manifestFile, 'utf8')); L60: if (opts?.includeDeps !== undefined) { ... L265: }); L266: response.once('end', () => resolveRequest({ status: response.statusCode ?? 0, body: Buffer.concat(chunks) })); L267: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/backup.jsView on unpkg · L3

lib/patch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.js#virtual:normalized:round1View on unpkg

src/client/MarketSection.tsxView file

•matchType = previous_version_dangerous_delta matchedPackage = dshhub-market@0.8.49 matchedIdentity = npm:ZHNoaHViLW1hcmtldA:0.8.49 similarity = 0.989 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/client/MarketSection.tsxView on unpkg

Source & flagged code

8 flagged

lib/cloud-bridge.jsView file

Lines 1-41javascript

1/**

2 * Cloud bridge: the publish channel that goes through the dshhub.co platform

3 * instead of a browser-to-localhost HTTP socket.

4 *

5 * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local

6 * network policy, Chrome Private Network Access preflight). The publish page

7 * used to probe http://127.0.0.1:3750 directly; creators would have had to

8 * change browser security settings — unacceptable. Instead this bridge

9 * registers with the platform on startup (getting a per-session secret),

10 * then polls an HTTPS task queue. The website creates tasks (scan / upload)

11 * and polls their results. Zero browser-to-localhost traffic.

12 *

13 * The local HTTP bridge (bridge.ts) stays for in-DSH install / update flows,

14 * which are process-internal and unaffected by browser policies.

15 *

16 * Lifecycle: register → poll loop (each poll doubles as heartbeat; the

17 * platform marks a session offline after 15 min without one) → execute

18 * tasks → report results. On 403 (secret invalidated) re-register.

19 */

20import { dirname, join } from 'node:path';

21import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';

22import { spawn } from 'node:child_process';

23import { hostname as osHostname, homedir } from 'node:os';

High

Child Process

Package source references child process execution.

lib/cloud-bridge.jsView on unpkg · L21

24import { profileDir } from './profile.js';

25import { readOwnVersion } from './self-update.js';

26import { scanPresets, scanSkills } from './preset-scan.js';

27import { publishUpload } from './bridge.js';

28/**

29 * 把本机桥接会话绑定到 dshhub 账号（配对码方案，0.8.47）：

30 * 遍历本机各 profile 的桥接状态文件，用网页端生成的 6 位配对码调用

31 * /api/bridge/bind 绑定。一次绑定永久生效——之后会话列表/任务派发按账号

32 * 隔离，不再依赖 IP（代理/VPN 无影响）。

33 */

34export async function bindToAccount(code) {

35 const c = typeof code === 'string' ? code.trim() : '';

36 if (!/^\d{6}$/.test(c))

37 return { ok: false, error: '配对码为 6 位数字' };

38 const home = process.env.DSH_HOME ?? join(homedir(), '.dsh');

39 const candidates = [];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/cloud-bridge.jsView on unpkg · L4

40 try {

41 candidates.push(...readdirSync(join(home, 'profiles')).filter((p) => !p.startsWith('.') && p !== 'node_modules'));

Lines 58-98javascript

58 });

59 const d = (await res.json().catch(() => ({})));

60 if (res.ok && d.ok)

61 return { ok: true };

62

lib/dsh-cli.jsView file

Lines 60-100javascript

60export const nodeBinDir = dirname(nodeExecutable());

61function spawnEnv() {

62 // pnpm v10+ blocks forever on a silent interactive prompt without a TTY;

63 // CI mode forces it to act or fail instead of asking.

64 const

lib/hot.jsView file

Lines 39-79javascript

39const HOT_MOUNT_TIMEOUT_MS = Number(process.env.DSH_MARKET_HOT_MOUNT_TIMEOUT_MS) || 10000;

40let hotTreeClass;

41/**

42 * The Include subclass, built once per process; null when the loader's include

43 * plugin is not importable (older harness) — callers fall back to restart.

44 */

lib/backup.jsView file

Lines 1-23javascript

1/**

2 * Portable profile backups: configuration only, never installed packages.

3 *

4 * The profile directory is plain user data — aside from package.json it can

5 * hold API keys (config.toml), tokens, or the WebDAV password when stored

6 * server-side. Backups therefore behave like `dsh export` and carry the same

7 * credential-warning disclaimer in the UI (review #63).

8 */

9import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'

lib/patch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.js#virtual:normalized:round1View on unpkg

src/client/MarketSection.tsxView file

•matchType = previous_version_dangerous_delta matchedPackage = dshhub-market@0.8.49 matchedIdentity = npm:ZHNoaHViLW1hcmtldA:0.8.49 similarity = 0.989 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/client/MarketSection.tsxView on unpkg