Loading npm security reports…

dshhub-market@0.8.54: Malicious npm security report (Block) | LPM Firewall

registry / dshhub-market / 0.8.54

dshhub-market@0.8.54

DeepSeek Harness 口令插件市场客户端：输码解锁插件，连接创作者与买家（DSHHub.co 驱动，fork of dsh-market）。

AI Security Review

scanned 3h ago · by lpm-firewall-ai

At runtime, the plugin silently establishes a remote-controlled bridge to dshhub.co. Remote tasks can inventory local profile content and upload selected local preset or skill files; it also performs unprompted remote self-updates.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading the plugin into a DSH host process.

Impact

The remote service can receive local profile inventory and selected file contents, and can cause replacement of the installed package.

Mechanism

Automatic task polling, local file packaging, upload, and tarball self-update.

Attack narrative

When the host imports this plugin, it starts a cloud bridge without a user action. The bridge polls dshhub.co for tasks, reports local preset and skill inventories, and accepts an upload task whose payload selects local content to package and send to the service. Separately, it checks a remote version endpoint and installs a server-selected tarball. These actions provide an unattended remote channel for local-content exfiltration and code replacement.

Rationale

The package creates an automatic remote command and update channel at import time, with server-directed collection and upload of local content. This is concrete unattended data exfiltration and remote payload replacement, despite the lack of an npm lifecycle hook.

Evidence

lib/index.jslib/cloud-bridge.jslib/publish.jslib/self-update.js

Network endpoints3

www.dshhub.cowww.dshhub.co/api/bridge/poll

Source & flagged code

7 flagged · loading source

lib/cloud-bridge.jsView file

21import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs'; L22: import { spawn } from 'node:child_process'; L23: import { hostname as osHostname, homedir } from 'node:os';

High

Child Process

Package source references child process execution.

lib/cloud-bridge.jsView on unpkg · L21

88: ['xdg-open', dir]; L89: spawn(cmd, args, { detached: true, stdio: 'ignore' }).unref(); L90: return { ok: true }; ... L95: } L96: /** 口令插件市场 API 地址（本地调试可 DSHHUB_API_URL=http://localhost:3000） */ L97: const DSHHUB_API = process.env.DSHHUB_API_URL ?? 'https://www.dshhub.co'; L98: /**

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/cloud-bridge.jsView on unpkg · L88

4* L5: * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local L6: * network policy, Chrome Private Network Access preflight). The publish page L7: * used to probe http://127.0.0.1:3750 directly; creators would have had to ... L21: import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs'; L22: import { spawn } from 'node:child_process'; L23: import { hostname as osHostname, homedir } from 'node:os'; ... L47: return { ok: false, error: '配对码为 6 位数字' }; L48: const home = process.env.DSH_HOME ?? join(homedir(), '.dsh'); L49: const candidates = []; ... L65: headers: { 'Content-Type': 'application/json' }, L66: body: JSON.stringify({ sessionId: state.sessionId, secret: state.secret, code: c }),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/cloud-bridge.jsView on unpkg · L4

lib/dsh-cli.jsView file

80export const winCmdShim = process.platform === 'win32'; L81: /** Characters cmd.exe treats as syntax even inside a token. */ L82: const CMD_METACHARS = /[\s"&|<>^()%!]/;

High

Shell

Package source references shell execution.

lib/dsh-cli.jsView on unpkg · L80

lib/hot.jsView file

59const specifier = '@deepseek-ai/cordis-plugin-include'; L60: const mod = (await import(__rewriteRelativeImportExtension(specifier))); L61: const Include = mod.Include;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/hot.jsView on unpkg · L59

lib/backup.jsView file

3* L4: * The profile directory is plain user data — aside from package.json it can L5: * hold API keys (config.toml), tokens, or the WebDAV password when stored ... L9: import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'; L10: import { lookup } from 'node:dns/promises'; L11: import { request as httpsRequest } from 'node:https'; ... L58: throw new Error('profile package.json is missing'); L59: const manifest = JSON.parse(readFileSync(manifestFile, 'utf8')); L60: if (opts?.includeDeps !== undefined) { ... L265: }); L266: response.once('end', () => resolveRequest({ status: response.statusCode ?? 0, body: Buffer.concat(chunks) })); L267: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/backup.jsView on unpkg · L3

lib/patch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.js#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged

lib/cloud-bridge.jsView file

Lines 1-41javascript

1/**

2 * Cloud bridge: the publish channel that goes through the dshhub.co platform

3 * instead of a browser-to-localhost HTTP socket.

4 *

5 * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local

6 * network policy, Chrome Private Network Access preflight). The publish page

7 * used to probe http://127.0.0.1:3750 directly; creators would have had to

8 * change browser security settings — unacceptable. Instead this bridge

9 * registers with the platform on startup (getting a per-session secret),

10 * then polls an HTTPS task queue. The website creates tasks (scan / upload)

11 * and polls their results. Zero browser-to-localhost traffic.

12 *

13 * The local HTTP bridge (bridge.ts) stays for in-DSH install / update flows,

14 * which are process-internal and unaffected by browser policies.

15 *

16 * Lifecycle: register → poll loop (each poll doubles as heartbeat; the

17 * platform marks a session offline after 15 min without one) → execute

18 * tasks → report results. On 403 (secret invalidated) re-register.

19 */

20import { dirname, join } from 'node:path';

21import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';

22import { spawn } from 'node:child_process';

23import { hostname as osHostname, homedir } from 'node:os';

High

Child Process

Package source references child process execution.

lib/cloud-bridge.jsView on unpkg · L21

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/cloud-bridge.jsView on unpkg · L4

24import { profileDir } from './profile.js';

25import { readOwnVersion } from './self-update.js';

26/** 简单语义化版本比较：'a.b.c' < 'x.y.z' 返回 true（用于升级门禁判断）。 */

27function isOlderVersion(v, min) {

28 const a = v.split('.').map((n) => parseInt(n, 10) || 0);

29 const b = min.split('.').map((n) => parseInt(n, 10) || 0);

30 for (let i = 0; i < 3; i++) {

31 if ((a[i] ?? 0) !== (b[i] ?? 0))

32 return (a[i] ?? 0) < (b[i] ?? 0);

33 }

34 return false;

35}

36import { scanPresets, scanSkills } from './preset-scan.js';

37import { publishUpload } from './bridge.js';

38/**

39 * 把本机桥接会话绑定到 dshhub 账号（配对码方案，0.8.47）：

40 * 遍历本机各 profile 的桥接状态文件，用网页端生成的 6 位配对码调用

41 * /api/bridge/bind 绑定。一次绑定永久生效——之后会话列表/任务派发按账号

Lines 68-108javascript

68 });

69 const d = (await res.json().catch(() => ({})));

70 if (res.ok && d.ok)

71 return { ok: true };

72

lib/dsh-cli.jsView file

Lines 60-100javascript

60export const nodeBinDir = dirname(nodeExecutable());

61function spawnEnv() {

62 // pnpm v10+ blocks forever on a silent interactive prompt without a TTY;

63 // CI mode forces it to act or fail instead of asking.

64 const

lib/hot.jsView file

Lines 39-79javascript

39const HOT_MOUNT_TIMEOUT_MS = Number(process.env.DSH_MARKET_HOT_MOUNT_TIMEOUT_MS) || 10000;

40let hotTreeClass;

41/**

42 * The Include subclass, built once per process; null when the loader's include

43 * plugin is not importable (older harness) — callers fall back to restart.

44 */

lib/backup.jsView file

Lines 1-23javascript

1/**

2 * Portable profile backups: configuration only, never installed packages.

3 *

4 * The profile directory is plain user data — aside from package.json it can

5 * hold API keys (config.toml), tokens, or the WebDAV password when stored

6 * server-side. Backups therefore behave like `dsh export` and carry the same

7 * credential-warning disclaimer in the UI (review #63).

8 */

9import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'

lib/patch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.js#virtual:normalized:round1View on unpkg