registry / dskcode / 0.1.47

dskcode@0.1.47

⚠ Under review

A DeepSeek-native AI coding agent for your terminal

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 360 file(s), 9.53 MB of source, external domains: api.deepseek.com, github.com, web.ifzq.gtimg.cn

Source & flagged code

6 flagged

dist/chunk-2R2C3BHJ.jsView file

Lines 1-2javascript

1import{a as p}from"./chunk-522BQUZS.js";import{a as r}from"./chunk-LAG2OMSH.js";import{a as i}from"./chunk-2NQMCQ7O.js";import{a}from"./chunk-QJGESXXN.js";import{a as t}from"./chunk-QP24BTOT.js";import{a as n}from"./chunk-QQZDJQIZ.js";import{d as e}from"./chunk-LPD7BHH5.js";e();var s=Object.freeze(JSON.parse(`{"displayName":"PHP","name":"php","patterns":[{"include":"#attribute"},{"include":"#comments"},{"captures":{"1":{"name":"keyword.other.namespace.php"},"2":{"name":"entity.name.type.namespace.php","patterns":[{"match":"\\\\\\\\","name":"punctuation.separator.inheritance.php"}]}},"match":"( ...

2//# sourceMappingURL=chunk-2R2C3BHJ.js.map

High

Child Process

Package source references child process execution.

dist/chunk-2R2C3BHJ.jsView on unpkg · L1

Long lines were clipped for display.

dist/vue-vine-Q32TIQRB.jsView file

Lines 1-2javascript

1import{a as r}from"./chunk-IL2UKTRC.js";import{a as s}from"./chunk-NE26G5AT.js";import{a as i}from"./chunk-S2PPVC2B.js";import{a as t}from"./chunk-HMJAMNJ2.js";import{a as n}from"./chunk-QP24BTOT.js";import{a}from"./chunk-QQZDJQIZ.js";

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import{a as td}from"./chunk-KMMG6QC6.js";import{a as Oe,b as Yn,c as Sa}from"./chunk-5Z3DMHRQ.js";import{a as ed}from"./chunk-MDFCAIOB.js";import{a as ma,b as ha,c as Ot,d as ga,e as Zu,f as

Source & flagged code

6 flagged · loading source

dist/chunk-2R2C3BHJ.jsView file

High

Child Process

Package source references child process execution.

dist/chunk-2R2C3BHJ.jsView on unpkg · L1

dist/vue-vine-Q32TIQRB.jsView file

1import{a as r}from"./chunk-IL2UKTRC.js";import{a as s}from"./chunk-NE26G5AT.js";import{a as i}from"./chunk-S2PPVC2B.js";import{a as t}from"./chunk-HMJAMNJ2.js";import{a as n}from".... L2: //# sourceMappingURL=vue-vine-Q32TIQRB.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/vue-vine-Q32TIQRB.jsView on unpkg · L1

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = dskcode@0.1.44 matchedIdentity = npm:ZHNrY29kZQ:0.1.44 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

552\u5220\u9664\u884C\u8303\u56F4\uFF1A\u7B2C ${u+1} \u884C ~ \u7B2C ${d+1} \u884C\uFF08\u5171 ${w} \u884C\uFF09 L553: \u53D8\u66F4\uFF1A+${g.additions} -${g.deletions}`,summary:x,diff:g}}catch(o){return{success:!1,data:`\u5220\u9664\u8303\u56F4\u5931\u8D25\uFF1A${o instanceof Error?o.message:Strin... L554: ${Ve(s.stderr)}`);let a=s.exitCode===0,l=i.length>0?i.join(` ... L562: ${s.join(` L563: `)}`),summary:`\u{1F4C2} ${a}\uFF08${s.length} \u9879\uFF09`}}catch(o){return{success:!1,data:`\u5217\u76EE\u5F55\u5931\u8D25\uFF1A${o instanceof Error?o.message:String(o)}`,error:... L564: \u5185\u5BB9\u7C7B\u578B: ${a}`,m=c.length>0?` L565: --- L566: `:"",h=e.url.length>60?e.url.slice(0,57)+"...":e.url,f=`\u{1F310} ${n} ${h} \u2192 ${i.status}`;return{success:i.ok,data:`${d}${m}${u}`,summary:f,error:i.ok?void 0:`HTTP_${i.status... L567: `);for(let r of n){let o=mT.exec(r);if(!o)continue;let s=o[1]??o[3]??"",i=Number(o[2]??o[4]??"0");if(!s)continue;let a=s.replace(/^file:\/\/\//,"").replace(/^file:\/\//,"");if(a.in...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L552

548\u5171\u6267\u884C ${e.edits.length} \u6B65\u66FF\u6362 L549: \u53D8\u66F4\uFF1A+${i.additions} -${i.deletions}`,summary:`\u{1F4DD} \u4FEE\u6539: ${jS(n)} (${e.edits.length} \u6B65, +${i.additions} -${i.deletions})`,diff:i}}catch(r){return{su... L550: `),i=Ym(s,e.startAnchor,"start_anchor");if("error"in i)return{success:!1,data:i.error,error:"ANCHOR_NOT_FOUND"};let a=Ym(s,e.endAnchor,"end_anchor");if("error"in a)return{success:!... ... L552: \u5220\u9664\u884C\u8303\u56F4\uFF1A\u7B2C ${u+1} \u884C ~ \u7B2C ${d+1} \u884C\uFF08\u5171 ${w} \u884C\uFF09 L553: \u53D8\u66F4\uFF1A+${g.additions} -${g.deletions}`,summary:x,diff:g}}catch(o){return{success:!1,data:`\u5220\u9664\u8303\u56F4\u5931\u8D25\uFF1A${o instanceof Error?o.message:Strin... L554: ${Ve(s.stderr)}`);let a=s.exitCode===0,l=i.length>0?i.join(` ... L562: ${s.join(` L563: `)}`),summary:`\u{1F4C2} ${a}\uFF08${s.length} \u9879\uFF09`}}catch(o){return{success:!1,data:`\u5217\u76EE\u5F55\u5931\u8D25\uFF1A${o instanceof Error?o.message:String(o)}`,error:... L564: \u5185\u5BB9\u7C7B\u578B: ${a}`,m=c.length>0?`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L548

2Cross-file remote execution chain: dist/index.js spawns dist/hack-FLOLYEQ5.js; helper contains network access plus dynamic code execution. L2: import{a as td}from"./chunk-KMMG6QC6.js";import{a as Oe,b as Yn,c as Sa}from"./chunk-5Z3DMHRQ.js";import{a as ed}from"./chunk-MDFCAIOB.js";import{a as ma,b as ha,c as Ot,d as ga,e ... L3: `)?u.replace(/(\r?\n)/g,s+"$1"+o):u)+s};return rp(i,Cb(e)).p={t,o:n,p:e.p},i.open=o,i.close=s,i},np=new function e(t=globalThis){let n=typeof t=="number"?t:(_=>{let S=_.process??{}... L4: `,"utf8")}async function nd(){let e=this.optsWithGlobals(),t=e.verbose??!1,n,r=[];try{let o=await Ot(e.config);if(n=o.config,o.errors.length>0)for(let s of o.errors)r.push(s.messag... ... L15: `));return}try{let{imported:s,skipped:i}=await zg(n);s.length>0&&console.log(Xe.green(` \u2714 \u5DF2\u5BFC\u5165 ${String(s.length)} \u4E2A skill \u5230 ~/.dskcode/skills`)),i.le... L16: `))}}async function Xg(){let e=tr();if(!Dt(e))return[];let t;try{t=await er(e)}catch{return[]}let n=[];for(let r of t){let o=Je(e,r);Qn(o).isDirectory()&&await nr(o)&&n.push(r)}ret... L17: `)}function $a(e,t=80){if(e===null)return"null";if(e===void 0)return"undefined";if(typeof e=="string")return …

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L2

Findings

1 Critical4 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/chunk-2R2C3BHJ.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighCross File Remote Execution Contextdist/index.js

MediumDynamic Requiredist/vue-vine-Q32TIQRB.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Lines 528-572javascript

528`);i.length>0&&i[i.length-1]===""&&s.endsWith(`

529`)&&i.pop();let a=Math.max(1,e.startLine??1)-1,l=e.endLine?Math.min(e.endLine,i.length):i.length,c=i.slice(a,l),u=String(l).length,d=c.map((w,x)=>`${String(a+x+1).padStart(u," ")}\u2192${w}`).join(`

530`),m=i.length-l,h=m>0?`

531

532[\u8FD8\u6709 ${m} \u884C\uFF1B\u4F7F\u7528 startLine=${l+1} \u7EE7\u7EED\u67E5\u770B]`:"",f=TS(t.cwd,n).replace(/\\/g,"/"),g=a>0||l<i.length?`\u7B2C ${a+1}-${l} \u884C`:`${i.length} \u884C`;return{success:!0,data:Ve(d)+h,summary:`\u{1F4D6} ${f}\uFF08${g}\uFF09`}}catch(r){return{success:!1,data:`\u8BFB\u53D6\u6587\u4EF6\u5931\u8D25\uFF1A${r instanceof Error?r.message:String(r)}`,error:"READ_ERROR"}}}};p();import{mkdir as PS,readFile as LS}from"fs/promises";import{dirname as $S,relative as OS,basename as DS}from"path";p();function xi(e){if(e.length===0)return{lines:[],eol:`

533`,eofStyle:"no-eol"};let t=e.indexOf(`\r

534`),n=e.indexOf(`

535`),r;t!==-1&&(n===-1||t<=n)?r=`\r

536`:r=`

537`;let o=e.split(r),s;return e.endsWith(r)?(o.length>0&&o[o.length-1]===""&&o.pop(),s="lf"):s="no-eol",{lines:o,eol:r,eofStyle:s}}function _S(e,t){let n=e.length,r=t.length;if(n===0&&r===0)return[];if(n===0)return t.map(l=>({op:"add",line:l}));if(r===0)return e.map(l=>({op:"remove",line:l}));let o=[],s=n+r,i=new Array(2*s+2).fill(-1),a=s;i[a+1]=0;for(let l=0;l<=s;l++){let c=new Map,u=-l,d=l;for(let m=u;m<=d;m+=2){let h=m+a,f;m===-l||m!==l&&i[h-1]<i[h+1]?f=i[h+1]:f=i[h-1]+1;let g=f-m;for(;f<n&&g<r&&e[f]===t[g];)f++,g++;if(i[h]=f,c.set(m,f),f>=n&&g>=r)return o.push(c),vS(o,n,r,e,t,a)}o.push(c)}re ...

538`)}function ES(e,t){let n=Lc(t),r=[];r.push("--- /dev/null"),r.push(`+++ b/${n}`),r.push(`@@ -0,0 +1,${String(e.length)} @@`);for(let o of e)r.push(`+${o}`);

539`)}function IS(e,t){let n=Lc(t),r=[];r.push(`--- a/${n}`),r.push("+++ /dev/null"),r.push(`@@ -1,${String(e.length)} +0,0 @@`);for(let o of e)r.push(`-${o}`);

540`)}function Lc(e){return e.replace(/\\/g,"/").split("/").pop()??e}function Kt(e,t,n){if(e===t)return{filePath:n,patch:"",existedBefore:e.length>0,additions:0

541`).length,l=Buffer.byteLength(s,"utf-8"),c=o?"\u5DF2\u4FEE\u6539":"\u5DF2\u521B\u5EFA",u=o?`\uFF0C+${i.additions} -${i.deletions}`:`\uFF0C+${i.additions} \u884C\uFF08\u65B0\u5EFA\uFF09`,d=DS(n),m=o?`\u{1F4DD} \u4FEE\u6539: ${d} (+${i.additions} -${i.deletions})`:`\u{1F4DD} \u65B0\u5EFA: ${d} (+${i.additions} \u884C)`;return{success:!0,data:`\u6587\u4EF6${c}\uFF1A${OS(t.cwd,n).replace(/\\/g,"/")}\uFF08${a} \u884C\uFF0C${l} \u5B57\u8282${u}\uFF09`,summary:m,diff:i}}catch(r){return{success:!1,data:`\u5199\u5165\u6587\u4EF6\u5931\u8D25\uFF1A${r instanceof Error?r.message:String(r)}`,error:"WRITE_E ...

542`).length,h=s.split(`

543`).length,f=Ue(e.new_text).split(`

544`).length,g=`+${u.additions} -${u.deletions}`,w=`\u{1F4DD} \u4FEE\u6539: ${BS(n)} (+${u.additions} -${u.deletions})`;return{success:!0,data:`\u6587\u4EF6\u5DF2\u7F16\u8F91\uFF1A${n}

545\u66FF\u6362\u4F4D\u7F6E\uFF1A\u7B2C ${m} \u884C

546${h} \u884C \u2192 ${f} \u884C

547\u53D8\u66F4\uFF1A${g}`,summary:w,diff:u}}catch(r){return{success:!1,data:`\u7F16\u8F91\u6587\u4EF6\u5931\u8D25\uFF1A${r instanceof Error?r.message:String(r)}`,error:"EDIT_ERROR"}}}};p();import{readFile as FS}from"fs/promises";import{writeFile as

548\u5171\u6267\u884C ${e.edits.length} \u6B65\u66FF\u6362

549\u53D8\u66F4\uFF1A+${i.additions} -${i.deletions}`,summary:`\u{1F4DD} \u4FEE\u6539: ${jS(n)} (${e.edits.length} \u6B65, +${i.additions} -${i.deletions})`,diff:i}}catch(r){return{success:!1,data:`\u6279\u91CF\u7F16\u8F91\u5931\u8D25\uFF1A${r instanceof Error?r.message:String(r)}`,error:"MULTI_EDIT_ERROR"}}}};p();import{readFile as US}from"fs/promises";import{writeFile as WS}from"fs/promises";import{basename as HS}from"path";function Ym(e,t,n){let r=Ue(t),o=[];for(let s=0;s<e.length;s++)Ue(e[s])===r&&o.push(s);return o.length===0?{error:`\u672A\u627E\u5230 "${n}" \u951A\u70B9\u884C\uFF0C\u8BF7\u ...

550`),i=Ym(s,e.startAnchor,"start_anchor");if("error"in i)return{success:!1,data:i.error,error:"ANCHOR_NOT_FOUND"};let a=Ym(s,e.endAnchor,"end_anchor");if("error"in a)return{success:!1,data:a.error,error:"ANCHOR_NOT_FOUND"};let l=i.line,c=a.line;if(l>=c)return{success:!1,data:"end_anchor \u5FC5\u987B\u5728 start_anchor \u4E4B\u540E",error:"ANCHOR_ORDER_ERROR"};let u=r?l:l+1,d=r?c:c-1;if(u>d)return{success:!1,data:"\u5220\u9664\u8303\u56F4\u4E3A\u7A7A\uFF08\u4E24\u884C\u951A\u70B9\u76F8\u90BB\u4E14 inclusive=false\uFF09",error:"EMPTY_RANGE"};let h=[...s.slice(0,u),...s.slice(d+1)].join(`

551`),f=fn(o,h);await WS(n,f,"utf-8");let g=Kt(o,f,n);g.existedBefore=!0;let w=d-u+1,x=`\u{1F4DD} \u4FEE\u6539: ${HS(n)} (\u5220 ${w} \u884C, +${g.additions} -${g.deletions})`;return{success:!0,data:`\u6587\u4EF6\u5DF2\u7F16\u8F91\uFF1A${n}

552\u5220\u9664\u884C\u8303\u56F4\uFF1A\u7B2C ${u+1} \u884C ~ \u7B2C ${d+1} \u884C\uFF08\u5171 ${w} \u884C\uFF09

553\u53D8\u66F4\uFF1A+${g.additions} -${g.deletions}`,summary:x,diff:g}}catch(o){return{success:!1,data:`\u5220\u9664\u8303\u56F4\u5931\u8D25\uFF1A${o instanceof Error?o.message:String(o)}`,error:"DELETE_RANGE_ERROR"}}}};p();import xr from"process";import{existsSync as Qm}from"fs";import{join as eh}from"path";var VS=xr.platform==="win32";function zS(){if(!VS)return{bin:"sh",args:["-c"],label:"sh",hint:"\u5F53\u524D shell \u662F bash \u517C\u5BB9\u8BED\u6CD5\uFF0C\u652F\u6301 pwd/ls/&&/\u7BA1\u9053\u7B49\u6807\u51C6 Unix \u5DE5\u5177\u3002"};let e=xr.env.DSKCODE_BASH;if(e&&Qm(e))return{bin:e,args: ...

554${Ve(s.stderr)}`);let a=s.exitCode===0,l=i.length>0?i.join(`

555`):"(\u65E0\u8F93\u51FA)",u=`\u{1F527} $ ${e.command.length>60?e.command.slice(0,57)+"...":e.command}\uFF08exit ${s.exitCode??"\u672A\u77E5"}\uFF09`;return{success:a,data:`${l

556[\u9000\u51FA\u7801: ${s.exitCode??"\u672A\u77E5"}]`,summary:u,error:a?void 0:`EXIT_CODE_${s.exitCode??"UNKNOWN"}`}}catch(r){return{success:!1,data:`\u547D\u4EE4\u6267\u884C\u5931\u8D25\uFF1A${r instanceof Error?r.message:String(r)}`

557`),d=a.length>l?`

558

559... \u5171 ${a.length} \u4E2A\u6587\u4EF6\uFF0C\u53EA\u663E\u793A\u524D ${l} \u4E2A`:"";return{success:!0,data:Ve(u+d),summary:`${e.pattern} \u2192 ${a.length} \u4E2A\u6587\u4EF6`}}catch(s){return{success:!1,data:`\u6587\u4EF6\u641C\u7D22\u5931\u8D25\uFF1A${s instanceof Error?s.message:String(s)}`,error:"GLOB_ERROR"}}}};p();import{readdir as YS,readFile as QS,stat as eT}from"fs/promises";import{join as oh,relative as tT,isAbsolute as nT}from"path";async function sh(e,t,n=200){let r=[],o;try{o=await YS(e,{withFileTypes:!0})}catch{return r}for(let s of o){if(r.length>=n)break;if(s.isDirectory()& ...

560`),w=tT(r,h);for(let x=0;x<g.length&&!(i.test(g[x]??"")&&(i.lastIndex=0,c.push({file:w,line:x+1,content:g[x]}),c.length>=500));x++);if(c.length>=500)break}catch{continue}

561`),d=new Set(c.map(h=>h.file)),m=`\u{1F50D} "${e.pattern}" \u2192 ${c.length} \u6761\u547D\u4E2D / ${d.size} \u4E2A\u6587\u4EF6`;return{success:!0,data:Ve(u),summary:m}}catch(s){return{success:!1,data:`

562${s.join(`

563`)}`),summary:`\u{1F4C2} ${a}\uFF08${s.length} \u9879\uFF09`}}catch(o){return{success:!1,data:`\u5217\u76EE\u5F55\u5931\u8D25\uFF1A${o instanceof Error?o.message:String(o)}`,error:"LS_ERROR"}}}};p();var jc={name:"fetch",kind:"read",description:"\u53D1\u8D77 HTTP \u8BF7\u6C42\u5E76\u8FD4\u56DE\u54CD\u5E94\u5185\u5BB9\u3002\u652F\u6301\u81EA\u5B9A\u4E49\u65B9\u6CD5\u548C\u8BF7\u6C42\u5934\u3002\u9002\u7528\u4E8E\u83B7\u53D6\u7F51\u9875\u5185\u5BB9\u3001API \u8C03\u7528\u7B49\u573A\u666F\u3002",parameters:{type:"object",properties:{url:{type:"string",description:"\u8BF7\u6C42\u7684 URL"},method:{ ...

564\u5185\u5BB9\u7C7B\u578B: ${a}`,m=c.length>0?`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L548

565---

566`:"",h=e.url.length>60?e.url.slice(0,57)+"...":e.url,f=`\u{1F310} ${n} ${h} \u2192 ${i.status}`;return{success:i.ok,data:`${d}${m}${u}`,summary:f,error:i.ok?void 0:`HTTP_${i

567`);for(let r of n){let o=mT.exec(r);if(!o)continue;let s=o[1]??o[3]??"",i=Number(o[2]??o[4]??"0");if(!s)continue;let a=s.replace(/^file:\/\/\//,"").replace(/^file:\/\//,"");if(a.includes(`${Un}${uh}${Un}`)||a.endsWith(`${Un}${uh}`)||a.includes(`${Un}node_modules${Un}`))continue;let l=a;return t&&a.startsWith(t)&&(l=a.slice(t.length).replace(/^[/\\]/,"")||Vc(a)),{file:l||Vc(a),line:i}}return{file:"<unknown>",line:0}}var hT=80,gT="\u2500".repeat(hT);function yT(e){let t=`[${e.time}] [${e.type}] @ ${e.loc.file}:${e.loc.line}`,n=JSON.stringify(e,null,2);return`${gT}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L552

568${t}

569${n}

570

571`}p();p();var wr=String.raw`(?:--[a-zA-Z0-9][-a-zA-Z0-9_]*(?:=[^\s]*)?\s+|-[a-zA-Z]+\s+)*`,_o=String.raw`(?:--\s+)?`,vo=String.raw`(

572\u26A0\uFE0F \u540C\u4E00\u5DE5\u5177\u91CD\u590D\u51FA\u9519\uFF0C\u5DF2\u5F3A\u5236\u5207\u6362\u7B56\u7565

Long lines were clipped for display.