dushaobindoudou/dsh-plugin-security
A supply-chain gate for DeepSeek Harness: audit any npm plugin before installing it and diff exactly what an update adds.
dsh-plugin-security is a supply-chain gate for DeepSeek Harness with two tools. plugin_security is a pre-install audit: give it an npm package name (or a local plugin directory), and it downloads the tarball straight from the registry, scans the shipped files and returns a permission card with a risk level (e.g. REVIEW) and a table of surfaces (install scripts, filesystem read, child processes, network, credential access, outbound hosts, credential-looking env), and every finding carries file:line evidence. plugin_security_diff is the update gate: point it at two versions and it reports what the update adds (capabilities and new outbound hosts), judging risk on the delta rather than on what you already accepted, so a bug-fix-only update stays clean.
Install
dsh plugin --profile web add dsh-plugin-securityCopied verbatim from the README's install line. The README frames the plugin as the gate in front of the plugin shop, which it says explicitly does not sandbox plugins.
Compatibility
The README is explicit that the dsh plugin shop does not sandbox plugins: once loaded, a plugin reaches your full ctx — filesystem, shell and the requests your model sends — which is exactly why this pre-install gate exists. Both tools parse tarballs in memory and write nothing to disk.
Details
- Repo: dushaobindoudou/dsh-plugin-security
- Category: Coding & Development
- Stars: 0
- Version: GitHub repo dushaobindoudou/dsh-plugin-security (MIT, per the README's License section); npm package dsh-plugin-security at 0.1.0 (registry check 2026-10-07).
FAQ
- Does the scan write anything to disk?
- No. The README says the scan is read-only by construction: nothing is written to disk and tarballs are parsed in memory.
- Why is the diff tool separate from the audit?
- The README explains the classic supply-chain attack is not the version you reviewed but the next one, so the diff judges risk on the delta the update adds.
Alternatives
030611/dsh-context-provenance · 030611/qiushi-dsh-evidence-audit · 121103qwq/dsh-vision-sidecar