Loading npm security reports…

dshost-plugin@0.1.8: Malicious npm security report (Block) | LPM Firewall

registry / dshost-plugin / 0.1.8

dshost-plugin@0.1.8

Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A configured plugin establishes a persistent relay connection and lets relay messages retrieve arbitrary local dotfiles or approved text files. It also proxies relay-controlled HTTP and WebSocket traffic to the local DSH service using its minted authentication cookie.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Loading the plugin with a token and automatic connection enabled.

Impact

A relay operator can obtain local secrets such as dotfiles and access the local DSH web interface through the agent.

Mechanism

Relay-controlled arbitrary-file read and authenticated local-service proxy.

Attack narrative

When loaded with a token, the package connects to a relay and registers that token. Relay messages select the artifact route, whose path parameter reaches fs.readFileSync without a directory allowlist; any dotfile is accepted. The file bytes are sent in relay responses. The same relay controls HTTP and WebSocket forwarding to the local DSH service, where the agent can add a minted authentication cookie.

Rationale

The source implements a remote-controlled channel for reading arbitrary local dotfiles and returning their contents over a relay, alongside authenticated proxying of a local service. This is a concrete data-exfiltration and remote-control surface, not merely ordinary telemetry.

Evidence

lib/index.jslib/core.js

Network endpoints1

wss://relay.example.com/agent

Decision evidence

Source & flagged code

6 flagged · loading source

lib/core.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = dshost-plugin@0.1.3 matchedIdentity = npm:ZHNob3N0LXBsdWdpbg:0.1.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.jsView on unpkg

9import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

4L5: import http from 'http'; L6: import os from 'os'; ... L9: import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws'; ... L14: // ── Backpressure / robustness limits ───────────────────────────────── L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10); L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/core.jsView on unpkg · L4

4L5: import http from 'http'; L6: import os from 'os'; ... L9: import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws'; ... L14: // ── Backpressure / robustness limits ───────────────────────────────── L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10); L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects ... L24: try { L25: for (const addrs of Object.values(os.networkInterfaces())) { L26: for (const a of addrs || []) {

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

lib/core.jsView on unpkg · L4

4Trigger-reachable credential exfiltration chain: manifest.main -> lib/index.js -> lib/core.js L4: L5: import http from 'http'; L6: import os from 'os'; ... L9: import crypto from 'crypto'; L10: import { execFileSync } from 'child_process'; L11: import WebSocket from 'ws'; ... L14: // ── Backpressure / robustness limits ───────────────────────────────── L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10); L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects ... L24: try { L25: for (const addrs of Object.values(os.networkInterfaces())) { L26: for (const a of addrs || []) {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

lib/core.jsView on unpkg · L4

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

6 flagged

lib/core.jsView file

Lines 1-29javascript

1// Shared agent core used by both the standalone agent (src/agent/dsh-remote.js)

2// and the dsh plugin (src/plugin/lib/index.js). Keeps the two entry points

3// thin so the forwarding/robustness logic cannot drift between them.

4

5import http from 'http';

6import os from 'os';

7import fs from 'fs';

8import path from 'path';

9import crypto from 'crypto';

10import { execFileSync } from 'child_process';

11import WebSocket from 'ws';

High

Child Process

Package source references child process execution.

lib/core.jsView on unpkg · L9

12import { send, b64, un64, sanitizeCloseCode } from './protocol.js';

13

14// ── Backpressure / robustness limits ─────────────────────────────────

15const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);

16const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/core.jsView on unpkg · L4

17const LOCAL_WS_CONNECT_TIMEOUT_MS = 15000; // give up if local dsh WS never opens

18const WS_SEND_HIGH_WATER = parseInt(process.env.WS_SEND_HIGH_WATER || String(8 * 1024 * 1024), 10);

19const RECONNECT_BASE_MS = 1000;

20const RECONNECT_MAX_MS = 60000;

21

22/** First non-internal IPv4 of this host (for the dashboard), or null. */

23function localIPv4() {

24 try {

25 for (const addrs of Object.values(os.networkInterfaces())) {

26 for (const a of addrs || []) {

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

lib/core.jsView on unpkg · L4

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

lib/core.jsView on unpkg · L4

27 if (a.family === 'IPv4' && !a.internal) return a.address;

28 }

29 }

•matchType = previous_version_dangerous_delta matchedPackage = dshost-plugin@0.1.3 matchedIdentity = npm:ZHNob3N0LXBsdWdpbg:0.1.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.jsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg