dshost-plugin@0.1.14

Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Lifecycle scripts only copy sources at pack time, and the relay client starts only when the host supplies a token. Disk collection, registration, and the upstream allowlist match that remote-access plugin rather than a separate attack chain.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A host calls apply() with a token and optional relay URL.

Impact

Effects stay inside the configured remote-access session; no unconsented install mutation or covert recipient was found.

Mechanism

The agent opens a websocket to that relay, registers, reports host inventory, and proxies allowlisted local upstreams.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json only defines prepack and prepare, both running scripts/prepack.mjs; there is no preinstall, install, or postinstall hook and no self-dependency.
apply() returns without connecting unless the caller supplies a token; the fallback relay is the placeholder wss://relay.example.com/agent.
collectDisks runs df -kPT only to fill the system-info payload sent to that configured relay after registration.
Service upstream hosts are accepted only for loopback, 10.144.144.0/24, or hosts listed in AGENT_UPSTREAM_ALLOW.
The websocket open handler registers with the caller-selected relay using the supplied token.

Evidence against

After a token is configured, the agent proxies local dsh traffic and can read text-like artifact paths requested by the relay, which is the remote-access feature rather than a hidden install action.
prepare rewrites lib copies from nearby source trees at pack time and does not run as a registry install hook.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVars

Source & flagged code

6 flagged

lib/core.jsView file

Lines 1-29javascript

1// Shared agent core used by both the standalone agent (src/agent/dsh-remote.js)

2// and the dsh plugin (src/plugin/lib/index.js). Keeps the two entry points

3// thin so the forwarding/robustness logic cannot drift between them.

5import http from 'http';

6import os from 'os';

7import fs from 'fs';

8import path from 'path';

9import crypto from 'crypto';

10import { execFileSync } from 'child_process';

11import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

12import { send, b64, un64, sanitizeCloseCode } from './protocol.js';

14// ── Backpressure / robustness limits ─────────────────────────────────

15const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);

16const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/core.jsView on unpkg · L4

17const LOCAL_WS_CONNECT_TIMEOUT_MS = 15000; // give up if local dsh WS never opens

18const WS_SEND_HIGH_WATER = parseInt(process.env.WS_SEND_HIGH_WATER || String(8 * 1024 * 1024), 10);

19const RECONNECT_BASE_MS = 1000;

20const RECONNECT_MAX_MS = 60000;

22/** First non-internal IPv4 of this host (for the dashboard), or null. */

23function localIPv4() {

24 try {

25 for (const addrs of Object.values(os.networkInterfaces())) {

26 for (const a of addrs || []) {

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

lib/core.jsView on unpkg · L4

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

lib/core.jsView on unpkg · L4

27 if (a.family === 'IPv4' && !a.internal) return a.address;

28 }

29 }

•matchType = previous_version_dangerous_delta matchedPackage = dshost-plugin@0.1.13 matchedIdentity = npm:ZHNob3N0LXBsdWdpbg:0.1.13 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.jsView on unpkg

package.jsonView file

Lines 1-36json

2 "name": "dshost-plugin",

3 "version": "0.1.14",

4 "description": "Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere",

5 "type": "module",

Source & flagged code

6 flagged · loading source

lib/core.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.jsView on unpkg

9import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

4L5: import http from 'http'; L6: import os from 'os'; ... L9: import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws'; ... L14: // ── Backpressure / robustness limits ───────────────────────────────── L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10); L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Findings

1 Critical4 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltalib/core.js

HighChild Processlib/core.js

HighSame File Env Network Executionlib/core.js

HighCredential Exfiltrationlib/core.js

HighTrigger Reachable Credential Exfiltrationlib/core.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to dshost-plugin@0.1.14.

See all versions of dshost-plugin for other recorded verdicts.

Review the evidence and your use of dshost-plugin@0.1.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:33:58.602Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.