Loading npm security reports…

dshhub-market@0.8.55: Malicious npm security report (Block) | LPM Firewall

registry / dshhub-market / 0.8.55

dshhub-market@0.8.55

DeepSeek Harness 口令插件市场客户端：输码解锁插件，连接创作者与买家（DSHHub.co 驱动，fork of dsh-market）。

AI Security Review

scanned 3h ago · by lpm-firewall-ai

On host startup, the package registers with dshhub.co and polls for server-issued tasks. It can scan local agent content, upload selected directories, and replace itself from a remote tarball without user confirmation.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the plugin in a DSH host with the default environment.

Impact

The platform can cause local skills or presets to be packaged and sent remotely, then replace the running package with new remote code.

Mechanism

Remote task execution and unverified self-update.

Attack narrative

After the host imports this package, it starts a persistent cloud bridge by default. The bridge accepts server task types that scan local presets and skills, then reports results or invokes the upload flow. That flow recursively packages selected local directories and posts them to dshhub.co. Separately, the package periodically accepts a remote version value and installs a platform tarball, allowing the remote service to replace its code without a checksum or user approval.

Rationale

This is a concrete autonomous remote-control and data-upload path, compounded by automatic unverified replacement of the package. The lack of an npm lifecycle hook does not remove the import-time behavior.

Evidence

lib/index.jslib/cloud-bridge.jslib/publish.jslib/self-update.js.dshhub-bridge.jsonSKILL.md

Network endpoints4

www.dshhub.co/api/bridge/register/api/bridge/poll

Source & flagged code

7 flagged · loading source

lib/cloud-bridge.jsView file

21import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs'; L22: import { spawn } from 'node:child_process'; L23: import { hostname as osHostname, homedir } from 'node:os';

High

Child Process

Package source references child process execution.

lib/cloud-bridge.jsView on unpkg · L21

88: ['xdg-open', dir]; L89: spawn(cmd, args, { detached: true, stdio: 'ignore' }).unref(); L90: return { ok: true }; ... L95: } L96: /** 口令插件市场 API 地址（本地调试可 DSHHUB_API_URL=http://localhost:3000） */ L97: const DSHHUB_API = process.env.DSHHUB_API_URL ?? 'https://www.dshhub.co'; L98: /**

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/cloud-bridge.jsView on unpkg · L88

4* L5: * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local L6: * network policy, Chrome Private Network Access preflight). The publish page L7: * used to probe http://127.0.0.1:3750 directly; creators would have had to ... L21: import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs'; L22: import { spawn } from 'node:child_process'; L23: import { hostname as osHostname, homedir } from 'node:os'; ... L47: return { ok: false, error: '配对码为 6 位数字' }; L48: const home = process.env.DSH_HOME ?? join(homedir(), '.dsh'); L49: const candidates = []; ... L65: headers: { 'Content-Type': 'application/json' }, L66: body: JSON.stringify({ sessionId: state.sessionId, secret: state.secret, code: c }),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/cloud-bridge.jsView on unpkg · L4

lib/dsh-cli.jsView file

80export const winCmdShim = process.platform === 'win32'; L81: /** Characters cmd.exe treats as syntax even inside a token. */ L82: const CMD_METACHARS = /[\s"&|<>^()%!]/;

High

Shell

Package source references shell execution.

lib/dsh-cli.jsView on unpkg · L80

lib/hot.jsView file

59const specifier = '@deepseek-ai/cordis-plugin-include'; L60: const mod = (await import(__rewriteRelativeImportExtension(specifier))); L61: const Include = mod.Include;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/hot.jsView on unpkg · L59

lib/backup.jsView file

3* L4: * The profile directory is plain user data — aside from package.json it can L5: * hold API keys (config.toml), tokens, or the WebDAV password when stored ... L9: import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'; L10: import { lookup } from 'node:dns/promises'; L11: import { request as httpsRequest } from 'node:https'; ... L58: throw new Error('profile package.json is missing'); L59: const manifest = JSON.parse(readFileSync(manifestFile, 'utf8')); L60: if (opts?.includeDeps !== undefined) { ... L265: }); L266: response.once('end', () => resolveRequest({ status: response.statusCode ?? 0, body: Buffer.concat(chunks) })); L267: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/backup.jsView on unpkg · L3

lib/patch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.js#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged

lib/cloud-bridge.jsView file

Lines 1-41javascript

1/**

2 * Cloud bridge: the publish channel that goes through the dshhub.co platform

3 * instead of a browser-to-localhost HTTP socket.

4 *

5 * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local

6 * network policy, Chrome Private Network Access preflight). The publish page

7 * used to probe http://127.0.0.1:3750 directly; creators would have had to

8 * change browser security settings — unacceptable. Instead this bridge

9 * registers with the platform on startup (getting a per-session secret),

10 * then polls an HTTPS task queue. The website creates tasks (scan / upload)

11 * and polls their results. Zero browser-to-localhost traffic.

12 *

13 * The local HTTP bridge (bridge.ts) stays for in-DSH install / update flows,

14 * which are process-internal and unaffected by browser policies.

15 *

16 * Lifecycle: register → poll loop (each poll doubles as heartbeat; the

17 * platform marks a session offline after 15 min without one) → execute

18 * tasks → report results. On 403 (secret invalidated) re-register.

19 */

20import { dirname, join } from 'node:path';

21import { existsSync, statSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';

22import { spawn } from 'node:child_process';

23import { hostname as osHostname, homedir } from 'node:os';

High

Child Process

Package source references child process execution.

lib/cloud-bridge.jsView on unpkg · L21

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/cloud-bridge.jsView on unpkg · L4

24import { profileDir } from './profile.js';

25import { readOwnVersion } from './self-update.js';

26/** 简单语义化版本比较：'a.b.c' < 'x.y.z' 返回 true（用于升级门禁判断）。 */

27function isOlderVersion(v, min) {

28 const a = v.split('.').map((n) => parseInt(n, 10) || 0);

29 const b = min.split('.').map((n) => parseInt(n, 10) || 0);

30 for (let i = 0; i < 3; i++) {

31 if ((a[i] ?? 0) !== (b[i] ?? 0))

32 return (a[i] ?? 0) < (b[i] ?? 0);

33 }

34 return false;

35}

36import { scanPresets, scanSkills } from './preset-scan.js';

37import { publishUpload } from './bridge.js';

38/**

39 * 把本机桥接会话绑定到 dshhub 账号（配对码方案，0.8.47）：

40 * 遍历本机各 profile 的桥接状态文件，用网页端生成的 6 位配对码调用

41 * /api/bridge/bind 绑定。一次绑定永久生效——之后会话列表/任务派发按账号

Lines 68-108javascript

68 });

69 const d = (await res.json().catch(() => ({})));

70 if (res.ok && d.ok)

71 return { ok: true };

72

lib/dsh-cli.jsView file

Lines 60-100javascript

60export const nodeBinDir = dirname(nodeExecutable());

61function spawnEnv() {

62 // pnpm v10+ blocks forever on a silent interactive prompt without a TTY;

63 // CI mode forces it to act or fail instead of asking.

64 const

lib/hot.jsView file

Lines 39-79javascript

39const HOT_MOUNT_TIMEOUT_MS = Number(process.env.DSH_MARKET_HOT_MOUNT_TIMEOUT_MS) || 10000;

40let hotTreeClass;

41/**

42 * The Include subclass, built once per process; null when the loader's include

43 * plugin is not importable (older harness) — callers fall back to restart.

44 */

lib/backup.jsView file

Lines 1-23javascript

1/**

2 * Portable profile backups: configuration only, never installed packages.

3 *

4 * The profile directory is plain user data — aside from package.json it can

5 * hold API keys (config.toml), tokens, or the WebDAV password when stored

6 * server-side. Backups therefore behave like `dsh export` and carry the same

7 * credential-warning disclaimer in the UI (review #63).

8 */

9import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'

lib/patch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.js#virtual:normalized:round1View on unpkg