dshost-plugin@0.1.5

Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 25.9 KB of source

Source & flagged code

2 flagged

lib/core.jsView file

Lines 1-29javascript

1// Shared agent core used by both the standalone agent (src/agent/dsh-remote.js)

2// and the dsh plugin (src/plugin/lib/index.js). Keeps the two entry points

3// thin so the forwarding/robustness logic cannot drift between them.

5import http from 'http';

6import os from 'os';

7import fs from 'fs';

8import path from 'path';

9import crypto from 'crypto';

10import { execFileSync } from 'child_process';

11import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

12import { send, b64, un64, sanitizeCloseCode } from './protocol.js';

14// ── Backpressure / robustness limits ─────────────────────────────────

15const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);

16const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/core.jsView on unpkg · L4

17const LOCAL_WS_CONNECT_TIMEOUT_MS = 15000; // give up if local dsh WS never opens

18const WS_SEND_HIGH_WATER = parseInt(process.env.WS_SEND_HIGH_WATER || String(8 * 1024 * 1024), 10);

19const RECONNECT_BASE_MS = 1000;

20const RECONNECT_MAX_MS = 60000;

22/** First non-internal IPv4 of this host (for the dashboard), or null. */

23function localIPv4() {

24 try {

25 for (const addrs of Object.values(os.networkInterfaces())) {

26 for (const a of addrs || []) {

27 if (a.family === 'IPv4' && !a.internal) return a.address;

28 }

29 }

Source & flagged code

2 flagged · loading source

lib/core.jsView file

9import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

4L5: import http from 'http'; L6: import os from 'os'; ... L9: import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws'; ... L14: // ── Backpressure / robustness limits ───────────────────────────────── L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10); L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/core.jsView on unpkg · L4

Findings

2 High2 Medium3 Low

HighChild Processlib/core.js

HighSame File Env Network Executionlib/core.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to dshost-plugin@0.1.5.

See all versions of dshost-plugin for other recorded verdicts.

Review the evidence and your use of dshost-plugin@0.1.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 22:08:03.988Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.