registry / Data exfiltration / dshost-plugin / 0.1.15

dshost-plugin@0.1.15

Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The source establishes an unconfined file-reading capability reachable through the remote relay. Because it is part of an artifact-viewing feature and requires the plugin's configured connection, warn about the risk rather than block the package.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The plugin starts with a configured token and auto-connect enabled, then receives a relay HTTP request for /api/host.artifact.

Impact

A relay request can disclose readable local files, including dotfiles, from the host.

Mechanism

The agent accepts supported text files and dotfiles, reads the supplied path, and returns the bytes over the relay.

AI rationale

Evidence

lib/index.jslib/core.js

Network endpoints1

wss://relay.example.com/agent

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package entry point is lib/index.js; the plugin starts the agent only when a token is configured and auto-connect is enabled.
A relay HTTP request without a target can enter the artifact viewer.
The artifact endpoint takes a requested path, and the reader permits dotfiles such as .env.
The reader stats and reads the supplied path without confining it to an artifacts directory, then returns the file bytes in the relay response.

Evidence against

The file reader is part of an explicitly labeled artifact-viewing feature, and the relay connection requires configured credentials and auto-connect.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 49.9 KB of source

Source & flagged code

6 flagged

lib/core.jsView file

Lines 1-29javascript

1// Shared agent core used by both the standalone agent (src/agent/dsh-remote.js)

2// and the dsh plugin (src/plugin/lib/index.js). Keeps the two entry points

3// thin so the forwarding/robustness logic cannot drift between them.

5import http from 'http';

6import os from 'os';

7import fs from 'fs';

8import path from 'path';

9import crypto from 'crypto';

10import { execFileSync } from 'child_process';

11import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

12import { send, b64, un64, sanitizeCloseCode } from './protocol.js';

14// ── Backpressure / robustness limits ─────────────────────────────────

15const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);

16const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/core.jsView on unpkg · L4

17const LOCAL_WS_CONNECT_TIMEOUT_MS = 15000; // give up if local dsh WS never opens

18const WS_SEND_HIGH_WATER = parseInt(process.env.WS_SEND_HIGH_WATER || String(8 * 1024 * 1024), 10);

19const RECONNECT_BASE_MS = 1000;

20const RECONNECT_MAX_MS = 60000;

22/** First non-internal IPv4 of this host (for the dashboard), or null. */

23function localIPv4() {

24 try {

25 for (const addrs of Object.values(os.networkInterfaces())) {

26 for (const a of addrs || []) {

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

lib/core.jsView on unpkg · L4

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

lib/core.jsView on unpkg · L4

27 if (a.family === 'IPv4' && !a.internal) return a.address;

28 }

29 }

•matchType = previous_version_dangerous_delta matchedPackage = dshost-plugin@0.1.14 matchedIdentity = npm:ZHNob3N0LXBsdWdpbg:0.1.14 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.jsView on unpkg

package.jsonView file

Lines 1-25json

2 "name": "dshost-plugin",

3 "version": "0.1.15",

4 "description": "Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere",

5 "type": "module",

Source & flagged code

6 flagged · loading source

lib/core.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.jsView on unpkg

9import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

4L5: import http from 'http'; L6: import os from 'os'; ... L9: import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws'; ... L14: // ── Backpressure / robustness limits ───────────────────────────────── L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10); L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Findings

1 Critical4 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltalib/core.js

HighChild Processlib/core.js

HighSame File Env Network Executionlib/core.js

HighCredential Exfiltrationlib/core.js

HighTrigger Reachable Credential Exfiltrationlib/core.js

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to dshost-plugin@0.1.15.

See all versions of dshost-plugin for other recorded verdicts.

Review the evidence and your use of dshost-plugin@0.1.15 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 03:45:13.385Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.