dshhub-market@0.8.60

⚠ Under review

DeepSeek Harness 口令插件市场客户端：输码解锁插件，连接创作者与买家（DSHHub.co 驱动，fork of dsh-market）。

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 22 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 91 file(s), 1.76 MB of source, external domains: 127.0.0.1, api.github.com, app.koofr.net, dav.example.com, dav.jianguoyun.com, get.pnpm.io, gist.github.com, github.com, nextcloud.example, player.bilibili.com, raw.githubusercontent.com, registry.npmjs.org, www.dshhub.co, www.w3.org, www.youtube.com

Source & flagged code

15 flagged

lib/hot.jsView file

Lines 39-79javascript

39const HOT_MOUNT_TIMEOUT_MS = Number(process.env.DSH_MARKET_HOT_MOUNT_TIMEOUT_MS) || 10000;

40let hotTreeClass;

41/**

42 * The Include subclass, built once per process; null when the loader's include

43 * plugin is not importable (older harness) — callers fall back to restart.

44 */

45/**

46 * Packages whose host import is replaced by a no-op shim. Client-only plugins

47 * (`dsh.client` without `dsh.bundle`) have no importable host half, but

48 * client-modules only serves bundles for packages with a live loader entry —

49 * the shim fiber exists purely to satisfy that registration.

50 */

51const shimNames = new Set();

52async function loadHotTreeClass() {

53 if (hotTreeClass !== undefined)

54 return hotTreeClass;

55 try {

56 // Computed specifier: the include plugin ships with the harness (vendored,

57 // unpublished), so it resolves at runtime through the profile fallback but

58 // is not typecheckable as a dependency.

59 const specifier = '@deepseek-ai/cordis-plugin-include';

60 const mod = (await import(__rewriteRelativeImportExtension(specifier)));

61 const Include = mod.Include;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/hot.jsView on unpkg · L59

62 if (Include === undefined)

63 throw new Error('no Include export');

64 class MarketHotTree extends Include {

65 /** Runtime-only mount list; the bundle layer owns persistence. */

66 write() { }

67 import(name, getOuterStack) {

68 if (shimNames.has(name))

69 return { name, apply: () => { } };

70 return super.import(name, getOuterStack);

71 }

72 }

73 hotTreeClass = MarketHotTree;

74 }

75 catch {

76 hotTreeClass = null;

77 }

78 return hotTreeClass;

79}

lib/cloud-bridge.jsView file

Lines 1-24javascript

1/**

2 * Cloud bridge: the publish channel that goes through the dshhub.co platform

3 * instead of a browser-to-localhost HTTP socket.

4 *

5 * Why: browsers block https-page → http://127.0.0.1 fetches (Safari local

6 * network policy, Chrome Private Network Access preflight). The publish page

7 * used to probe http://127.0.0.1:3750 directly; creators would have had to

8 * change browser security settings — unacceptable. Instead this bridge

9 * registers with the platform on startup (getting a per-session secret),

10 * then polls an HTTPS task queue. The website creates tasks (scan / upload)

lib/backup.jsView file

Lines 1-23javascript

1/**

2 * Portable profile backups: configuration only, never installed packages.

3 *

4 * The profile directory is plain user data — aside from package.json it can

5 * hold API keys (config.toml), tokens, or the WebDAV password when stored

6 * server-side. Backups therefore behave like `dsh export` and carry the same

7 * credential-warning disclaimer in the UI (review #63).

8 */

9import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs'

lib/patch.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/patch.js#virtual:normalized:round1View on unpkg

lib/restart.jsView file

•matchType = normalized_sha256 matchedPackage = dshhub-market@0.8.50 matchedPath = lib/restart.js matchedIdentity = npm:ZHNoaHViLW1hcmtldA:0.8.50 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High