registry / dshost-plugin / 0.1.1

dshost-plugin@0.1.1

Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 20.6 KB of source

Source & flagged code

2 flagged

lib/core.jsView file

Lines 1-28javascript

1// Shared agent core used by both the standalone agent (src/agent/dsh-remote.js)

2// and the dsh plugin (src/plugin/lib/index.js). Keeps the two entry points

3// thin so the forwarding/robustness logic cannot drift between them.

5import http from 'http';

6import os from 'os';

7import fs from 'fs';

8import crypto from 'crypto';

9import { execFileSync } from 'child_process';

10import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L8

11import { send, b64, un64, sanitizeCloseCode } from './protocol.js';

13// ── Backpressure / robustness limits ─────────────────────────────────

14const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);

15const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/core.jsView on unpkg · L4

16const LOCAL_WS_CONNECT_TIMEOUT_MS = 15000; // give up if local dsh WS never opens

17const WS_SEND_HIGH_WATER = parseInt(process.env.WS_SEND_HIGH_WATER || String(8 * 1024 * 1024), 10);

18const RECONNECT_BASE_MS = 1000;

19const RECONNECT_MAX_MS = 60000;

21/** First non-internal IPv4 of this host (for the dashboard), or null. */

22function localIPv4() {

23 try {

24 for (const addrs of Object.values(os.networkInterfaces())) {

25 for (const a of addrs || []) {

26 if (a.family === 'IPv4' && !a.internal) return a.address;

27 }

28 }

Source & flagged code

2 flagged · loading source

lib/core.jsView file

8import crypto from 'crypto'; L9: import { execFileSync } from 'child_process'; L10: import WebSocket from 'ws';

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code