dshost-plugin@0.1.13

Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere

AI Security Review

scanned 29d ago · by lpm-firewall-ai

Scripts are pack-time only, and the relay starts from the host apply entry after a user token is supplied. Disk collection, system metadata, and artifact reads stay inside that configured remote-access session rather than an install-time or hidden exfiltration chain.

Static reason

No blocking static signals were detected.

Trigger

The host calls apply with a token and autoConnect is not disabled. Registry install does not run a lifecycle hook.

Impact

No unconsented install mutation, covert payload fetch, or independent credential theft was identified. Remote file and UI access occurs only inside the user-started relay session.

Mechanism

startAgent opens a WebSocket to the configured relay and proxies local dsh HTTP and WebSocket traffic. Shell use is limited to df with fixed arguments.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json only defines prepack and prepare, both invoking scripts/prepack.mjs. There is no preinstall, install, or postinstall hook.
The relay WebSocket opens only from startAgent after a token is present. A missing token returns a no-op stop function.
The only child process is execFileSync of df with the fixed argument list -kPT, used to inventory disks.
lib/index.js starts the agent from the host apply() call, using the configured token and relay URL, defaulting to the placeholder wss://relay.example.com/agent.

Evidence against

After registration, a relay http:request to /api/host.artifact can read a caller-supplied text path, including .env, and send the bytes back on that same WebSocket.
On connect the agent reports hostname, address, disk, and installed-plugin metadata to the configured relay.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

Source & flagged code

6 flagged

lib/core.jsView file

Lines 1-29javascript

1// Shared agent core used by both the standalone agent (src/agent/dsh-remote.js)

2// and the dsh plugin (src/plugin/lib/index.js). Keeps the two entry points

3// thin so the forwarding/robustness logic cannot drift between them.

5import http from 'http';

6import os from 'os';

7import fs from 'fs';

8import path from 'path';

9import crypto from 'crypto';

10import { execFileSync } from 'child_process';

11import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

12import { send, b64, un64, sanitizeCloseCode } from './protocol.js';

14// ── Backpressure / robustness limits ─────────────────────────────────

15const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);

16const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/core.jsView on unpkg · L4

17const LOCAL_WS_CONNECT_TIMEOUT_MS = 15000; // give up if local dsh WS never opens

18const WS_SEND_HIGH_WATER = parseInt(process.env.WS_SEND_HIGH_WATER || String(8 * 1024 * 1024), 10);

19const RECONNECT_BASE_MS = 1000;

20const RECONNECT_MAX_MS = 60000;

22/** First non-internal IPv4 of this host (for the dashboard), or null. */

23function localIPv4() {

24 try {

25 for (const addrs of Object.values(os.networkInterfaces())) {

26 for (const a of addrs || []) {

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

lib/core.jsView on unpkg · L4

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

lib/core.jsView on unpkg · L4

27 if (a.family === 'IPv4' && !a.internal) return a.address;

28 }

29 }

Lines 363-403javascript

363 */

364export function startAgent(opts) {

365 const {

366 token,

367 relayUrl,

368 version = '0.1.0',

package.jsonView file

Lines 1-36json

2 "name": "dshost-plugin",

3 "version": "0.1.13",

4 "description": "Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere",

5 "type": "module",

Source & flagged code

6 flagged · loading source

lib/core.jsView file

9import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

4L5: import http from 'http'; L6: import os from 'os'; ... L9: import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws'; ... L14: // ── Backpressure / robustness limits ───────────────────────────────── L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10); L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/core.jsView on unpkg · L4

Findings

4 High2 Medium6 Low

HighChild Processlib/core.js

HighSame File Env Network Executionlib/core.js

HighCredential Exfiltrationlib/core.js

HighTrigger Reachable Credential Exfiltrationlib/core.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencelib/core.js

Affected versions and remediation

This report applies to dshost-plugin@0.1.13.

See all versions of dshost-plugin for other recorded verdicts.

Review the evidence and your use of dshost-plugin@0.1.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-23 23:46:08.030Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.