registry / dshost-plugin / 0.1.3

dshost-plugin@0.1.3

Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 24.8 KB of source

Source & flagged code

3 flagged

lib/core.jsView file

Lines 1-29javascript

1// Shared agent core used by both the standalone agent (src/agent/dsh-remote.js)

2// and the dsh plugin (src/plugin/lib/index.js). Keeps the two entry points

3// thin so the forwarding/robustness logic cannot drift between them.

5import http from 'http';

6import os from 'os';

7import fs from 'fs';

8import path from 'path';

9import crypto from 'crypto';

10import { execFileSync } from 'child_process';

11import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

12import { send, b64, un64, sanitizeCloseCode } from './protocol.js';

14// ── Backpressure / robustness limits ─────────────────────────────────

15const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);

16const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/core.jsView on unpkg · L4

17const LOCAL_WS_CONNECT_TIMEOUT_MS = 15000; // give up if local dsh WS never opens

18const WS_SEND_HIGH_WATER = parseInt(process.env.WS_SEND_HIGH_WATER || String(8 * 1024 * 1024), 10);

19const RECONNECT_BASE_MS = 1000;

20const RECONNECT_MAX_MS = 60000;

22/** First non-internal IPv4 of this host (for the dashboard), or null. */

23function localIPv4() {

24 try {

25 for (const addrs of Object.values(os.networkInterfaces())) {

26 for (const a of addrs || []) {

27 if (a.family === 'IPv4' && !a.internal) return a.address;

28 }

29 }

•matchType = previous_version_dangerous_delta matchedPackage = dshost-plugin@0.1.2 matchedIdentity = npm:ZHNob3N0LXBsdWdpbg:0.1.2 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.jsView on unpkg

Source & flagged code

3 flagged · loading source

lib/core.jsView file

9import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws';

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code