dshost-plugin@0.1.11
Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source establishes a relay-mediated arbitrary local text/dotfile read path, creating material credential and data exposure risk. It lacks automatic install-time mutation or a hidden payload chain, so the evidence supports a warning rather than a block.
Static reason
No blocking static signals were detected.
Trigger
Loading the plugin with a token and automatic connection enabled, followed by a relay HTTP request to /api/host.artifact.
Impact
A party controlling or authorized to use the relay token could obtain sensitive dotfiles such as .npmrc or .env if their paths are requested.
Mechanism
Relay-directed local file read and WebSocket response.
AI rationale
The source establishes a relay-mediated arbitrary local text/dotfile read path, creating material credential and data exposure risk. It lacks automatic install-time mutation or a hidden payload chain, so the evidence supports a warning rather than a block.
Evidence
lib/index.jslib/core.jsarbitrary local text files and dotfiles selected by relay request
Network endpoints1
wss://relay.example.com/agent
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- When loaded with a token, the plugin starts an outbound relay agent.
- The relay-controlled artifact endpoint accepts a supplied path and reads text files or dotfiles.
- Read file contents are Base64-encoded and sent back over the relay WebSocket.
Evidence against
- There is no preinstall, install, or postinstall hook; the only lifecycle hook is prepare.
- The package does not self-depend or write consumer configuration.
- The remote relay and local DSH proxy are the package's implemented product function.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcelib/core.jsView file
9import crypto from 'crypto';
L10: import { execFileSync } from 'child_process';
L11: import WebSocket from 'ws';
High
4L5: import http from 'http';
L6: import os from 'os';
...
L9: import crypto from 'crypto';
L10: import { execFileSync } from 'child_process';
L11: import WebSocket from 'ws';
...
L14: // ── Backpressure / robustness limits ─────────────────────────────────
L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);
L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/core.jsView on unpkg · L44L5: import http from 'http';
L6: import os from 'os';
...
L9: import crypto from 'crypto';
L10: import { execFileSync } from 'child_process';
L11: import WebSocket from 'ws';
...
L14: // ── Backpressure / robustness limits ─────────────────────────────────
L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);
L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects
...
L24: try {
L25: for (const addrs of Object.values(os.networkInterfaces())) {
L26: for (const a of addrs || []) {
Findings
6 High2 Medium4 Low
HighChild Processlib/core.js
HighShell
HighSame File Env Network Executionlib/core.js
HighCredential Exfiltrationlib/core.js
HighTrigger Reachable Credential Exfiltrationlib/core.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to dshost-plugin@0.1.11.
See all versions of dshost-plugin for other recorded verdicts.
- Review the evidence and your use of dshost-plugin@0.1.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.