Loading npm security reports…

dshhub-market@0.8.51: Malicious npm security report (Block) | LPM Firewall

registry / dshhub-market / 0.8.51

dshhub-market@0.8.51

DeepSeek Harness 口令插件市场客户端：输码解锁插件，连接创作者与买家（DSHHub.co 驱动，fork of dsh-market）。

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Loading the DSH plugin automatically creates a persistent remote task channel. The service can request local profile scans and uploads, while a separate timer replaces the installed package from a remote tarball.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

DSH loading this plugin; no UI action is required unless the user has set the opt-out environment variables.

Impact

A remote service can obtain scanned profile metadata and cause selected local skill or preset contents to be uploaded; it can also replace this package with remotely served code.

Mechanism

Automatic remote task polling, local content upload, and remote self-update.

Attack narrative

When the DSH host loads the package, it starts a cloud bridge by default. The bridge registers host information, polls the remote service indefinitely, and executes server-provided scan or upload tasks. Scan results are reported to the service, and upload tasks recursively archive local skill or preset directories before posting them remotely. Independently, the package periodically checks a remote version endpoint and invokes the DSH plugin installer with a remote tarball URL. These actions occur without a per-task local user confirmation.

Rationale

This is an automatically activated remote-control and upload channel with remote self-replacement, not merely a user-invoked marketplace operation. The lack of an npm lifecycle hook does not remove the runtime attack surface created on host load.

Evidence

lib/index.jslib/cloud-bridge.jslib/publish.jslib/self-update.js.dshhub-bridge.jsonskills/<name>presets/<name>

Source & flagged code

8 flagged · loading source

lib/cloud-bridge.jsView file

21import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs'; L22: import { spawn } from 'node:child_process'; L23: import { hostname as osHostname, homedir } from 'node:os';

High

Child Process

Package source references child process execution.

lib/cloud-bridge.jsView on unpkg · L21

78: ['xdg-open', dir]; L79: spawn(cmd, args, { detached: true, stdio: 'ignore' }).unref(); L80: return { ok: true }; ... L85: } L86: /** 口令插件市场 API 地址（本地调试可 DSHHUB_API_URL=http://localhost:3000） */ L87: const DSHHUB_API = process.env.DSHHUB_API_URL ?? 'https://www.dshhub.co'; L88: /**

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/cloud-bridge.jsView on unpkg · L78

4* L5: * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local L6: * network policy, Chrome Private Network Access preflight). The publish page L7: * used to probe http://127.0.0.1:3750 directly; creators would have had to ... L21: import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs'; L22: import { spawn } from 'node:child_process'; L23: import { hostname as osHostname, homedir } from 'node:os'; ... L37: return { ok: false, error: '配对码为 6 位数字' }; L38: const home = process.env.DSH_HOME ?? join(homedir(), '.dsh'); L39: const candidates = []; ... L55: headers: { 'Content-Type': 'application/json' }, L56: body: JSON.stringify({ sessionId: state.sessionId, secret: state.secret, code: c }),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/cloud-bridge.jsView on unpkg · L4

lib/dsh-cli.jsView file

80export const winCmdShim = process.platform === 'win32'; L81: /** Characters cmd.exe treats as syntax even inside a token. */ L82: const CMD_METACHARS = /[\s"&|<>^()%!]/;

High

Shell

Package source references shell execution.

lib/dsh-cli.jsView on unpkg · L80

lib/hot.jsView file

59const specifier = '@deepseek-ai/cordis-plugin-include'; L60: const mod = (await import(__rewriteRelativeImportExtension(specifier))); L61: const Include = mod.Include;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/hot.jsView on unpkg · L59

lib/backup.jsView file

3* L4: * The profile directory is plain user data — aside from package.json it can L5: * hold API keys (config.toml), tokens, or the WebDAV password when stored ... L9: import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'; L10: import { lookup } from 'node:dns/promises'; L11: import { request as httpsRequest } from 'node:https'; ... L58: throw new Error('profile package.json is missing'); L59: const manifest = JSON.parse(readFileSync(manifestFile, 'utf8')); L60: if (opts?.includeDeps !== undefined) { ... L265: }); L266: response.once('end', () => resolveRequest({ status: response.statusCode ?? 0, body: Buffer.concat(chunks) })); L267: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/backup.jsView on unpkg · L3

lib/patch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.js#virtual:normalized:round1View on unpkg

src/client/MarketSection.tsxView file

•matchType = previous_version_dangerous_delta matchedPackage = dshhub-market@0.8.50 matchedIdentity = npm:ZHNoaHViLW1hcmtldA:0.8.50 similarity = 0.968 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/client/MarketSection.tsxView on unpkg

Source & flagged code

8 flagged

lib/cloud-bridge.jsView file

Lines 1-41javascript

1/**

2 * Cloud bridge: the publish channel that goes through the dshhub.co platform

3 * instead of a browser-to-localhost HTTP socket.

4 *

5 * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local

6 * network policy, Chrome Private Network Access preflight). The publish page

7 * used to probe http://127.0.0.1:3750 directly; creators would have had to

8 * change browser security settings — unacceptable. Instead this bridge

9 * registers with the platform on startup (getting a per-session secret),

10 * then polls an HTTPS task queue. The website creates tasks (scan / upload)

11 * and polls their results. Zero browser-to-localhost traffic.

12 *

13 * The local HTTP bridge (bridge.ts) stays for in-DSH install / update flows,

14 * which are process-internal and unaffected by browser policies.

15 *

16 * Lifecycle: register → poll loop (each poll doubles as heartbeat; the

17 * platform marks a session offline after 15 min without one) → execute

18 * tasks → report results. On 403 (secret invalidated) re-register.

19 */

20import { dirname, join } from 'node:path';

21import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';

22import { spawn } from 'node:child_process';

23import { hostname as osHostname, homedir } from 'node:os';

High

Child Process

Package source references child process execution.

lib/cloud-bridge.jsView on unpkg · L21

24import { profileDir } from './profile.js';

25import { readOwnVersion } from './self-update.js';

26import { scanPresets, scanSkills } from './preset-scan.js';

27import { publishUpload } from './bridge.js';

28/**

29 * 把本机桥接会话绑定到 dshhub 账号（配对码方案，0.8.47）：

30 * 遍历本机各 profile 的桥接状态文件，用网页端生成的 6 位配对码调用

31 * /api/bridge/bind 绑定。一次绑定永久生效——之后会话列表/任务派发按账号

32 * 隔离，不再依赖 IP（代理/VPN 无影响）。

33 */

34export async function bindToAccount(code) {

35 const c = typeof code === 'string' ? code.trim() : '';

36 if (!/^\d{6}$/.test(c))

37 return { ok: false, error: '配对码为 6 位数字' };

38 const home = process.env.DSH_HOME ?? join(homedir(), '.dsh');

39 const candidates = [];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/cloud-bridge.jsView on unpkg · L4

40 try {

41 candidates.push(...readdirSync(join(home, 'profiles')).filter((p) => !p.startsWith('.') && p !== 'node_modules'));

Lines 58-98javascript

58 });

59 const d = (await res.json().catch(() => ({})));

60 if (res.ok && d.ok)

61 return { ok: true };

62

lib/dsh-cli.jsView file

Lines 60-100javascript

60export const nodeBinDir = dirname(nodeExecutable());

61function spawnEnv() {

62 // pnpm v10+ blocks forever on a silent interactive prompt without a TTY;

63 // CI mode forces it to act or fail instead of asking.

64 const

lib/hot.jsView file

Lines 39-79javascript

39const HOT_MOUNT_TIMEOUT_MS = Number(process.env.DSH_MARKET_HOT_MOUNT_TIMEOUT_MS) || 10000;

40let hotTreeClass;

41/**

42 * The Include subclass, built once per process; null when the loader's include

43 * plugin is not importable (older harness) — callers fall back to restart.

44 */

lib/backup.jsView file

Lines 1-23javascript

1/**

2 * Portable profile backups: configuration only, never installed packages.

3 *

4 * The profile directory is plain user data — aside from package.json it can

5 * hold API keys (config.toml), tokens, or the WebDAV password when stored

6 * server-side. Backups therefore behave like `dsh export` and carry the same

7 * credential-warning disclaimer in the UI (review #63).

8 */

9import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'

lib/patch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.js#virtual:normalized:round1View on unpkg

src/client/MarketSection.tsxView file

•matchType = previous_version_dangerous_delta matchedPackage = dshhub-market@0.8.50 matchedIdentity = npm:ZHNoaHViLW1hcmtldA:0.8.50 similarity = 0.968 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/client/MarketSection.tsxView on unpkg