dsh-poison-guard

v0.2.0 · 1 天前发布

Pre-install supply-chain poison scanner for DeepSeek Harness plugins: AST analysis (NodeSecure JS-X-Ray) + deobfuscation decoder + regex heuristics to catch credential exfiltration, dynamic code execution, obfuscated imports, and install-time scripts.

deepseek-harnessdsh-pluginsecuritysupply-chainauditmalwaresastastobfuscationjs-x-ray

README

dsh-poison-guard

![CI](https://github.com/zoahdev/dsh-poison-guard/actions/workflows/ci.yml)
![License: MIT](LICENSE)
![Release](https://github.com/zoahdev/dsh-poison-guard/releases)

Pre-install supply-chain poison scanner for DeepSeek Harness plugins. It is
not a toy regex grep: it runs three layers on every plugin before you dsh plugin add it —

1. AST analysis via NodeSecure JS-X-Ray
(the SAST used by NodeSecure CLI): variable tracing, dynamic-import resolution,
obfuscator detection, eval/Function/vm sinks, data-exfiltration,

查看完整 README →

版本兼容矩阵

DSH 版本	状态	说明
`dsh@0.1.0-rc.6`	✅ 兼容	cordis patch ✅
`dsh@0.1.0`	✅ 兼容	标准 patch ✅
`dsh@0.2.0`	⚠️ 待验证	待实测（API 可能在变）
`dsh@0.3.0+`	❓ 未知	尚未发布

💡 兼容矩阵每周末自动跑实测，欢迎 PR 修正

元数据

License: MIT
npm: dsh-poison-guard
Repo: git+https://github.com/zoahdev/dsh-poison-guard.git
Engines: {"node":">=18"}
Weekly DL: 0
Monthly DL: 0
dsh.bundle: {"bundle":{"patch":"./cordis.patch.yml"}}