registry / Credential exfiltration / dshost-plugin

dshost-plugin

Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere

This report shows the evidence for dshost-plugin@0.1.8. 1 of 12 known versions is blocked or flagged. The newest version, 0.1.15, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source implements a remote-controlled channel for reading arbitrary local dotfiles and returning their contents over a relay, alongside authenticated proxying of a local service. This is a concrete data-exfiltration and remote-control surface, not merely ordinary telemetry.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Loading the plugin with a token and automatic connection enabled.

Impact

A relay operator can obtain local secrets such as dotfiles and access the local DSH web interface through the agent.

Mechanism

Relay-controlled arbitrary-file read and authenticated local-service proxy.

Attack narrative

When loaded with a token, the package connects to a relay and registers that token. Relay messages select the artifact route, whose path parameter reaches fs.readFileSync without a directory allowlist; any dotfile is accepted. The file bytes are sent in relay responses. The same relay controls HTTP and WebSocket forwarding to the local DSH service, where the agent can add a minted authentication cookie.

AI rationale

Evidence

lib/index.jslib/core.js

Network endpoints1

wss://relay.example.com/agent

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

The plugin automatically starts a relay agent when configured with a token.
The agent sends its registration token and host system information to the relay.
Relay-controlled requests can invoke an artifact endpoint.
That endpoint accepts any dotfile path and reads the selected local file before returning it over the relay.
The agent also forwards relay requests into the authenticated local DSH web service.

Evidence against

The manifest has no install, postinstall, or preinstall lifecycle hook.
The only fixed relay URL is an example placeholder; a real relay URL is supplied by configuration.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 35.9 KB of source

Source & flagged code

6 flagged

lib/core.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = dshost-plugin@0.1.3 matchedIdentity = npm:ZHNob3N0LXBsdWdpbg:0.1.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.jsView on unpkg

9import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

4L5: import http from 'http'; L6: import os from 'os'; ... L9: import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws'; ... L14: // ── Backpressure / robustness limits ───────────────────────────────── L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10); L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/core.jsView on unpkg · L4

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

lib/core.jsView on unpkg · L4

4Trigger-reachable credential exfiltration chain: manifest.main -> lib/index.js -> lib/core.js L4: L5: import http from 'http'; L6: import os from 'os'; ... L9: import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws'; ... L14: // ── Backpressure / robustness limits ───────────────────────────────── L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10); L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects ... L24: try { L25: for (const addrs of Object.values(os.networkInterfaces())) { L26: for (const a of addrs || []) {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

lib/core.jsView on unpkg · L4

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

6 flagged · loading source

lib/core.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.jsView on unpkg

9import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Findings

1 Critical6 High2 Medium3 Low

CriticalPrevious Version Dangerous Deltalib/core.js

HighChild Processlib/core.js

HighShell

HighSame File Env Network Executionlib/core.js

HighCredential Exfiltrationlib/core.js

HighTrigger Reachable Credential Exfiltrationlib/core.js

HighSemantic Analysis Limitedpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to dshost-plugin@0.1.8.

The versions list below shows the verdict for each recorded version.

Avoid installing dshost-plugin@0.1.8. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-31 09:26:32.804Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

12 known versions

0.1.15latestSuspiciousData ExfiltrationWarnPublishedOct 19, 2026, 3:31 AM 0.1.14Clean—AllowPublishedSep 26, 2026, 3:32 AM 0.1.13Clean—AllowPublishedSep 23, 2026, 5:32 PM 0.1.12SuspiciousData ExfiltrationWarnPublishedSep 11, 2026, 6:54 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Related packages

Other credential exfiltration packages

Source & flagged code