dshhub-market@0.8.53: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

dshhub-market@0.8.53: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

lib/cloud-bridge.jsView file

21import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs'; L22: import { spawn } from 'node:child_process'; L23: import { hostname as osHostname, homedir } from 'node:os';

High

Child Process

Package source references child process execution.

lib/cloud-bridge.jsView on unpkg · L21

88: ['xdg-open', dir]; L89: spawn(cmd, args, { detached: true, stdio: 'ignore' }).unref(); L90: return { ok: true }; ... L95: } L96: /** 口令插件市场 API 地址（本地调试可 DSHHUB_API_URL=http://localhost:3000） */ L97: const DSHHUB_API = process.env.DSHHUB_API_URL ?? 'https://www.dshhub.co'; L98: /**

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/cloud-bridge.jsView on unpkg · L88

4* L5: * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local L6: * network policy, Chrome Private Network Access preflight). The publish page L7: * used to probe http://127.0.0.1:3750 directly; creators would have had to ... L21: import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs'; L22: import { spawn } from 'node:child_process'; L23: import { hostname as osHostname, homedir } from 'node:os'; ... L47: return { ok: false, error: '配对码为 6 位数字' }; L48: const home = process.env.DSH_HOME ?? join(homedir(), '.dsh'); L49: const candidates = []; ... L65: headers: { 'Content-Type': 'application/json' }, L66: body: JSON.stringify({ sessionId: state.sessionId, secret: state.secret, code: c }),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/cloud-bridge.jsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = dshhub-market@0.8.51 matchedIdentity = npm:ZHNoaHViLW1hcmtldA:0.8.51 similarity = 0.957 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cloud-bridge.jsView on unpkg

lib/dsh-cli.jsView file

80export const winCmdShim = process.platform === 'win32'; L81: /** Characters cmd.exe treats as syntax even inside a token. */ L82: const CMD_METACHARS = /[\s"&|<>^()%!]/;

High

Shell

Package source references shell execution.

lib/dsh-cli.jsView on unpkg · L80

lib/hot.jsView file

59const specifier = '@deepseek-ai/cordis-plugin-include'; L60: const mod = (await import(__rewriteRelativeImportExtension(specifier))); L61: const Include = mod.Include;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/hot.jsView on unpkg · L59

lib/backup.jsView file

3* L4: * The profile directory is plain user data — aside from package.json it can L5: * hold API keys (config.toml), tokens, or the WebDAV password when stored ... L9: import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'; L10: import { lookup } from 'node:dns/promises'; L11: import { request as httpsRequest } from 'node:https'; ... L58: throw new Error('profile package.json is missing'); L59: const manifest = JSON.parse(readFileSync(manifestFile, 'utf8')); L60: if (opts?.includeDeps !== undefined) { ... L265: }); L266: response.once('end', () => resolveRequest({ status: response.statusCode ?? 0, body: Buffer.concat(chunks) })); L267: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/backup.jsView on unpkg · L3

lib/patch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged

lib/cloud-bridge.jsView file

Lines 1-41javascript

1/**

2 * Cloud bridge: the publish channel that goes through the dshhub.co platform

3 * instead of a browser-to-localhost HTTP socket.

4 *

5 * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local

6 * network policy, Chrome Private Network Access preflight). The publish page

7 * used to probe http://127.0.0.1:3750 directly; creators would have had to

8 * change browser security settings — unacceptable. Instead this bridge

9 * registers with the platform on startup (getting a per-session secret),

10 * then polls an HTTPS task queue. The website creates tasks (scan / upload)

11 * and polls their results. Zero browser-to-localhost traffic.

12 *

13 * The local HTTP bridge (bridge.ts) stays for in-DSH install / update flows,

14 * which are process-internal and unaffected by browser policies.

15 *

16 * Lifecycle: register → poll loop (each poll doubles as heartbeat; the

17 * platform marks a session offline after 15 min without one) → execute

18 * tasks → report results. On 403 (secret invalidated) re-register.

19 */

20import { dirname, join } from 'node:path';

21import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';

22import { spawn } from 'node:child_process';

23import { hostname as osHostname, homedir } from 'node:os';

High

Child Process

Package source references child process execution.

lib/cloud-bridge.jsView on unpkg · L21

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/cloud-bridge.jsView on unpkg · L4

24import { profileDir } from './profile.js';

25import { readOwnVersion } from './self-update.js';

26/** 简单语义化版本比较：'a.b.c' < 'x.y.z' 返回 true（用于升级门禁判断）。 */

27function isOlderVersion(v, min) {

28 const a = v.split('.').map((n) => parseInt(n, 10) || 0);

29 const b = min.split('.').map((n) => parseInt(n, 10) || 0);

30 for (let i = 0; i < 3; i++) {

31 if ((a[i] ?? 0) !== (b[i] ?? 0))

32 return (a[i] ?? 0) < (b[i] ?? 0);

33 }

34 return false;

35}

36import { scanPresets, scanSkills } from './preset-scan.js';

37import { publishUpload } from './bridge.js';

38/**

39 * 把本机桥接会话绑定到 dshhub 账号（配对码方案，0.8.47）：

40 * 遍历本机各 profile 的桥接状态文件，用网页端生成的 6 位配对码调用

41 * /api/bridge/bind 绑定。一次绑定永久生效——之后会话列表/任务派发按账号

Lines 68-108javascript

68 });

69 const d = (await res.json().catch(() => ({})));

70 if (res.ok && d.ok)

71 return { ok: true };

72

•matchType = previous_version_dangerous_delta matchedPackage = dshhub-market@0.8.51 matchedIdentity = npm:ZHNoaHViLW1hcmtldA:0.8.51 similarity = 0.957 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cloud-bridge.jsView on unpkg

lib/dsh-cli.jsView file

Lines 60-100javascript

60export const nodeBinDir = dirname(nodeExecutable());

61function spawnEnv() {

62 // pnpm v10+ blocks forever on a silent interactive prompt without a TTY;

63 // CI mode forces it to act or fail instead of asking.

64 const

lib/hot.jsView file

Lines 39-79javascript

39const HOT_MOUNT_TIMEOUT_MS = Number(process.env.DSH_MARKET_HOT_MOUNT_TIMEOUT_MS) || 10000;

40let hotTreeClass;

41/**

42 * The Include subclass, built once per process; null when the loader's include

43 * plugin is not importable (older harness) — callers fall back to restart.

44 */

lib/backup.jsView file

Lines 1-23javascript

1/**

2 * Portable profile backups: configuration only, never installed packages.

3 *

4 * The profile directory is plain user data — aside from package.json it can

5 * hold API keys (config.toml), tokens, or the WebDAV password when stored

6 * server-side. Backups therefore behave like `dsh export` and carry the same

7 * credential-warning disclaimer in the UI (review #63).

8 */

9import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'

lib/patch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.js#virtual:normalized:round1View on unpkg