dshost-plugin@0.1.9
Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is not an automatic install-time malware chain, but its runtime relay protocol exposes arbitrary eligible local files to the configured remote service. This is a material dangerous capability that warrants a warning rather than a publish block.
Static reason
No blocking static signals were detected.
Trigger
The DSH host loads the plugin with a token and autoConnect enabled; the connected relay sends a request.
Impact
An entity controlling the configured relay or its authorized session could obtain readable local configuration or artifact files up to 2 MiB, including dotfiles.
Mechanism
Authenticated relay tunnel with arbitrary local artifact reads and local DSH proxying.
AI rationale
The package is not an automatic install-time malware chain, but its runtime relay protocol exposes arbitrary eligible local files to the configured remote service. This is a material dangerous capability that warrants a warning rather than a publish block.
Evidence
lib/index.jslib/core.js/etc/machine-id/var/lib/dbus/machine-id
Network endpoints1
wss://relay.example.com/agent
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Loading the plugin with a configured token automatically starts a relay agent.
- The agent registers that token with a configurable remote WebSocket relay.
- Relay messages can request an arbitrary local path through the artifact endpoint; dotfiles and permitted text extensions are read and sent back.
- Relay requests are proxied to the local DSH service with its minted authentication cookie.
Evidence against
- There is no self-dependency, install-time network action, or destructive lifecycle behavior.
- The relay connection requires a user-supplied token and can be disabled with autoConnect.
- Declared extra service targets are restricted to loopback, a fixed mesh range, or an explicit allowlist.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcelib/core.jsView file
9import crypto from 'crypto';
L10: import { execFileSync } from 'child_process';
L11: import WebSocket from 'ws';
High
4L5: import http from 'http';
L6: import os from 'os';
...
L9: import crypto from 'crypto';
L10: import { execFileSync } from 'child_process';
L11: import WebSocket from 'ws';
...
L14: // ── Backpressure / robustness limits ─────────────────────────────────
L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);
L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/core.jsView on unpkg · L44L5: import http from 'http';
L6: import os from 'os';
...
L9: import crypto from 'crypto';
L10: import { execFileSync } from 'child_process';
L11: import WebSocket from 'ws';
...
L14: // ── Backpressure / robustness limits ─────────────────────────────────
L15: const MAX_WS_BUFFERED_BYTES = parseInt(process.env.MAX_WS_BUFFERED_BYTES || String(16 * 1024 * 1024), 10);
L16: const MAX_PENDING_FRAMES = 1024; // frames buffered while local WS connects
...
L24: try {
L25: for (const addrs of Object.values(os.networkInterfaces())) {
L26: for (const a of addrs || []) {
Findings
6 High2 Medium4 Low
HighChild Processlib/core.js
HighShell
HighSame File Env Network Executionlib/core.js
HighCredential Exfiltrationlib/core.js
HighTrigger Reachable Credential Exfiltrationlib/core.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to dshost-plugin@0.1.9.
See all versions of dshost-plugin for other recorded verdicts.
- Review the evidence and your use of dshost-plugin@0.1.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.