{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"blank-not-black-dsh-remote-plugin","slug":"blank-not-black-dsh-remote-plugin","rank":190,"url":"https://github.com/Blank-not-black/dsh-Remote/tree/main/packages/plugin","name":"Blank-not-black/dsh-Remote#plugin","category":"remote","description":{"zh":"移动远程控制套件：原生侧边栏入口 + 管理抽屉的 bundle 插件，自带 Bearer 令牌网关自愈（局域网/Tailscale）；Android App 覆盖会话/审批/提问/goal；/fs/* 文件端点（Range 断点续传、2GB 上传）；多服务器测速自动切换；聊天记录离线缓存。","en":"Mobile remote-control suite: bundle plugin with native sidebar entry and admin drawer, self-healing bearer-token gateway over LAN/Tailscale, Android app (sessions/approvals/questions/goals), /fs/* file transfer (Range resume, 2GB upload), latency-based multi-server auto-switch, offline chat cache."},"stars":18,"starsCheckedAt":"2026-08-21","repository":{"owner":"Blank-not-black","repo":"dsh-Remote","requestedRef":"main","subpath":"packages/plugin"},"npm":"dsh-remote-plugin","downloads":3609,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-remote-plugin","tarball":null,"added":"2026-08-15","page":"https://awesome-dsh-plugin.com/p/Blank-not-black/dsh-Remote--packages-plugin/","screenshots":["https://raw.githubusercontent.com/Blank-not-black/dsh-Remote/main/docs/screenshots/mobile-sessions.png","https://raw.githubusercontent.com/Blank-not-black/dsh-Remote/main/docs/screenshots/mobile-approvals.png","https://raw.githubusercontent.com/Blank-not-black/dsh-Remote/main/docs/screenshots/mobile-files.png","https://raw.githubusercontent.com/Blank-not-black/dsh-Remote/main/docs/screenshots/mobile-settings.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"blank-not-black-dsh-remote-plugin","slug":"blank-not-black-dsh-remote-plugin","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:22:03.816Z","scanStatus":"static-complete","verdict":"caution","score":89,"commit":"a323f04ce53431aea5ac0b08b61418109567dfb9","commitDate":"2026-08-22T14:14:38+08:00","artifactDigest":"sha256:125963e022a20ea5c31e5b5d1ac285d2b5ab83a7953cc5485b2306956b3fc63f","downloadUrl":"https://github.com/Blank-not-black/dsh-Remote/archive/a323f04ce53431aea5ac0b08b61418109567dfb9.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-remote-plugin","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-remote-plugin","packageVersion":"0.6.10-rc.1","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-slots"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-remote-plugin","manifestName":"dsh-remote-plugin","nameMatch":true,"npm":{"name":"dsh-remote-plugin","latestVersion":"0.6.7","publishedAt":"2026-08-21T10:34:17.575Z","createdAt":"2026-08-15T14:03:41.429Z","versionCount":23,"maintainers":1,"repository":"git+https://github.com/Blank-not-black/dsh-Remote.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-remote","name":"dsh-remote-plugin","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","network","session","subprocess"],"outboundHosts":[{"host":"dsh-remote.local","count":2},{"host":"gitee.com","count":2},{"host":"space.bilibili.com","count":2},{"host":"api.github.com","count":1},{"host":"feedback.blankalwaysgoeson.site","count":1},{"host":"en.wikipedia.org","count":1},{"host":"www.d-project.com","count":1},{"host":"www.opensource.org","count":1},{"host":"www.denso-wave.com","count":1},{"host":"stackoverflow.com","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"gateway-stats.cjs","pathClass":"source","line":23,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"447c83aba5724f51ea1c03ea"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"gateway.cjs","pathClass":"source","line":29,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f16816fdb5a5686d2eba7b25"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"index.mjs","pathClass":"source","line":8,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0107f98b65787e0ecb9e8632"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"index.mjs","pathClass":"source","line":8,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"35c8565c89b76238012ca327"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"public/admin.js","pathClass":"source","line":61,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"2dfe924bdedea0fb795af957"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"public/admin.js","pathClass":"source","line":62,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"2dfe924bdedea0fb795af957"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"public/app.js","pathClass":"source","line":266,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"4659766a6235cec3ba5cbfdc"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"public/app.js","pathClass":"source","line":267,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"4659766a6235cec3ba5cbfdc"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"public/desktop/desktop.js","pathClass":"source","line":137,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"0f9203184f64dd3937cad3d5"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"public/desktop/desktop.js","pathClass":"source","line":140,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"0f9203184f64dd3937cad3d5"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"public/plugin.js","pathClass":"source","line":34,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"422ff03d70adf167a6781747"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"public/plugin.js","pathClass":"source","line":57,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"422ff03d70adf167a6781747"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"gateway.cjs","pathClass":"source","line":71,"evidence":"credential access at line 71 + outbound network at line 420","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"09979e3f52861efa869ab5af","review":{"verdict":"functional","reason":"TOKEN_FILE(71行)仅定义本地Bearer令牌存储路径用于网关自身鉴权，结合UPSTREAM转发到本地DSH(3080端口)及GitHub更新检查，是网关声明功能的必要组成，无证据表明令牌被发往第三方。","model":"sonnet","reviewedAt":"2026-08-22T08:22:03.816Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"index.mjs","pathClass":"source","line":44,"evidence":"credential access at line 44 + outbound network at line 120","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"4118711f12cc6e56cc5e3a36","review":{"verdict":"functional","reason":"gatewayToken() 读取本地 token 文件仅用于向 gatewayBase() 即 127.0.0.1 本地网关发起代理请求做管理台数据聚合，未发往第三方地址，符合抽屉代理本地网关的设计意图。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:21:34.227Z"}}],"counts":{"critical":0,"high":0,"medium":10,"low":4},"rawCounts":{"critical":0,"high":0,"medium":10,"low":4},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":29,"bytesScanned":1153919,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":2,"source":18,"cordis":1,"manifest":1,"html":4,"data":3}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:22:03.816Z","summary":"该插件自述为移动远程控制网关，代码中TOKEN_FILE用于存储本地Bearer令牌以鉴权远程连接，UPSTREAM默认指向本地127.0.0.1:3080的DSH实例，符合“网关自愈+令牌鉴权+文件互传”的描述意图。由于420行代码未在提供片段中完整展示，无法百分之百确认网络调用未夹带凭据外发，但结合上下文（本地代理+GitHub更新检查URL）更符合自建网关的正常功能，未见明显外泄证据。建议用户关注TOKEN_FILE路径权限及UPDATE_CHECK_URL是否可被环境变量劫持指向恶意地址。","intentMatch":"consistent","findingsReviewed":2,"findingsCandidates":2,"fromCache":1,"usage":{"inputTokens":2,"outputTokens":1413,"costUsd":0.028312,"durationMs":19179}}},"timeline":[{"scannedAt":"2026-08-22T08:22:03.816Z","commit":"a323f04ce53431aea5ac0b08b61418109567dfb9","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:21:34.227Z","commit":"ae2330b9bc0d1b92fa4c84716204637ffef51fdb","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:49:44.958Z","commit":"ae2330b9bc0d1b92fa4c84716204637ffef51fdb","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"a323f04ce53431aea5ac0b08b61418109567dfb9","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:22:03.816Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"ae2330b9bc0d1b92fa4c84716204637ffef51fdb","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:21:34.227Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"ae2330b9bc0d1b92fa4c84716204637ffef51fdb","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:49:44.958Z"}]}