dshost-plugin@0.1.12
Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source establishes a remote-access tunnel with a relay-controlled arbitrary local file-read feature. It is not an install-time malware chain, but the feature creates unresolved credential and data-exfiltration risk.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The plugin is loaded with a token and automatic connection enabled; the connected relay sends an artifact request containing a local path.
Impact
Sensitive local configuration and source files can be exposed to the relay.
Mechanism
Relay-controlled arbitrary local text and dotfile read over WebSocket.
AI rationale
The source establishes a remote-access tunnel with a relay-controlled arbitrary local file-read feature. It is not an install-time malware chain, but the feature creates unresolved credential and data-exfiltration risk.
Evidence
lib/core.js
Network endpoints1
wss://relay.example.com/agent
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The relay-controlled artifact endpoint reads an arbitrary supplied local path when it is a text-type or dotfile, then sends its contents over the relay connection.
- Loading the configured plugin starts a persistent WebSocket relay agent that accepts relay HTTP and WebSocket requests.
Evidence against
- The package has no install, preinstall, or postinstall hook; its prepare script only copies build sources into lib.
- No self-dependency, dynamic code execution, or destructive filesystem action was found.
- The relay URL and token are supplied through plugin configuration or environment variables, consistent with a remote-access plugin.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcelib/core.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = dshost-plugin@0.1.9
matchedIdentity = npm:ZHNob3N0LXBsdWdpbg:0.1.9
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/core.jsView on unpkg9import crypto from 'crypto';
L10: import { execFileSync } from 'child_process';
L11: import WebSocket from 'ws';
High
4L5: import http from 'http';
L6: import os from 'os';
...
L9: import crypto from 'crypto';
L10: import { execFileSync } from 'child_process';
L11: import WebSocket from 'ws';
...
L14: // ── Backpressure / robustness limits ─────────────────────────────────
L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);
L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical6 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltalib/core.js
HighChild Processlib/core.js
HighShell
HighSame File Env Network Executionlib/core.js
HighCredential Exfiltrationlib/core.js
HighTrigger Reachable Credential Exfiltrationlib/core.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to dshost-plugin@0.1.12.
See all versions of dshost-plugin for other recorded verdicts.
- Review the evidence and your use of dshost-plugin@0.1.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.