{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"dsh-market-dsh-market","slug":"dsh-market-dsh-market","rank":11,"url":"https://github.com/dsh-market/dsh-market","name":"dsh-market/dsh-market","category":"market","description":{"zh":"在 DeepSeek Harness 设置页内浏览、搜索并安装社区插件，支持分类筛选、一键更新与停用，以及主题切换与配置备份。","en":"Browse, search and install community plugins from inside DeepSeek Harness settings, with category filters, one-click updates, enable/disable, theme switching and configuration backup."},"stars":1670,"starsCheckedAt":"2026-08-21","repository":{"owner":"dsh-market","repo":"dsh-market","requestedRef":null,"subpath":""},"npm":"dshmarket","downloads":107654,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dshmarket","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/dsh-market/dsh-market/","screenshots":["https://raw.githubusercontent.com/dsh-market/dsh-market/main/assets/demo-en.png","https://raw.githubusercontent.com/dsh-market/dsh-market/main/assets/themes-en.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"dsh-market-dsh-market","slug":"dsh-market-dsh-market","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:19:36.841Z","scanStatus":"static-complete","verdict":"pass","score":99,"commit":"b9323cc85d0148013384a5aca5215be1922eea36","commitDate":"2026-08-22T12:10:14+08:00","artifactDigest":"sha256:2c19b1c392f16e25f21f082f76139af6064d8a589431b7ab79d8ed9b044a785b","downloadUrl":"https://github.com/dsh-market/dsh-market/archive/b9323cc85d0148013384a5aca5215be1922eea36.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dshmarket","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dshmarket","packageVersion":"1.18.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-connection","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-theme"],"platform":"web"},"lifecycleScripts":{"prepare":"npm run build"},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-settings"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dshmarket","manifestName":"dshmarket","nameMatch":true,"npm":{"name":"dshmarket","latestVersion":"1.17.1","publishedAt":"2026-08-21T06:38:27.226Z","createdAt":"2026-08-13T15:33:59.185Z","versionCount":61,"maintainers":1,"repository":"git+https://github.com/dsh-market/dsh-market.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"attested","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-market","name":"dshmarket","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","session","subprocess","telemetry"],"outboundHosts":[{"host":"get.pnpm.io","count":4},{"host":"dav.example","count":3},{"host":"images.weserv.nl","count":2},{"host":"dav.jianguoyun.com","count":2},{"host":"app.koofr.net","count":2},{"host":"nextcloud.example","count":2},{"host":"awesome-dsh-plugin.com","count":2},{"host":"www.npmjs.com","count":2},{"host":"dav.example.com","count":2},{"host":"gist.github.com","count":2},{"host":"dshmarket.com","count":1},{"host":"www.sitemaps.org","count":1},{"host":"evil.example","count":1},{"host":"api.github.com","count":1}],"findings":[{"id":"HT-INSTALL-002","title":"Git 安装会触发 prepare 构建脚本","severity":"medium","confidence":"low","layer":"supply-chain","path":"package.json","pathClass":"manifest","line":31,"evidence":"\"prepare\": \"npm run build\"","remediation":"发布预构建制品（npm 或 GitHub Release tarball），并记录源码与发布包的一致性证明。","note":"该插件以 npm/tarball 预构建方式分发，prepare 不在用户机器上执行","hash":"d28b218339321374f2793b3b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/smoke-spawn.mjs","pathClass":"source","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ba5c30abb713cce92bbd1fd4"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/smoke-spawn.mjs","pathClass":"source","line":8,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ba5c30abb713cce92bbd1fd4"},{"id":"HT-CLIENT-002","title":"加载第三方统计或广告脚本","severity":"medium","confidence":"low","layer":"static","path":"site/browse-template.html","pathClass":"test-example-docs","line":54,"evidence":"<script defer src='https://static.cloudflareinsights.com/beacon.min.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","note":"向 static.cloudflareinsights.com 发送浏览行为数据；位于测试、示例或文档目录","hash":"f79bf92464fc8c9e9e5aa6d3"},{"id":"HT-CLIENT-002","title":"加载第三方统计或广告脚本","severity":"medium","confidence":"low","layer":"static","path":"site/index.en.html","pathClass":"test-example-docs","line":52,"evidence":"<script type='module' src='https://static.cloudflareinsights.com/beacon.min.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","note":"向 static.cloudflareinsights.com 发送浏览行为数据；位于测试、示例或文档目录","hash":"a0ad0cd16b0e03f360b8fa6c"},{"id":"HT-CLIENT-002","title":"加载第三方统计或广告脚本","severity":"medium","confidence":"low","layer":"static","path":"site/index.zh.html","pathClass":"test-example-docs","line":51,"evidence":"<script type='module' src='https://static.cloudflareinsights.com/beacon.min.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","note":"向 static.cloudflareinsights.com 发送浏览行为数据；位于测试、示例或文档目录","hash":"cfd622fc6032b3ccbe86a0b1"},{"id":"HT-CLIENT-002","title":"加载第三方统计或广告脚本","severity":"medium","confidence":"low","layer":"static","path":"site/plugin-template.html","pathClass":"test-example-docs","line":76,"evidence":"<script defer src='https://static.cloudflareinsights.com/beacon.min.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","note":"向 static.cloudflareinsights.com 发送浏览行为数据；位于测试、示例或文档目录","hash":"56c3db45bdf6745662c4c648"},{"id":"HT-CLIENT-002","title":"加载第三方统计或广告脚本","severity":"medium","confidence":"low","layer":"static","path":"site/privacy.en.html","pathClass":"test-example-docs","line":55,"evidence":"<script type='module' src='https://static.cloudflareinsights.com/beacon.min.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","note":"向 static.cloudflareinsights.com 发送浏览行为数据；位于测试、示例或文档目录","hash":"b190b16c567162a9316d6051"},{"id":"HT-CLIENT-002","title":"加载第三方统计或广告脚本","severity":"medium","confidence":"low","layer":"static","path":"site/privacy.zh.html","pathClass":"test-example-docs","line":55,"evidence":"<script type='module' src='https://static.cloudflareinsights.com/beacon.min.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","note":"向 static.cloudflareinsights.com 发送浏览行为数据；位于测试、示例或文档目录","hash":"c449f22d9417fe21fc50792f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/dsh-cli.ts","pathClass":"source","line":6,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"68a02d88ec9206b8db51fe36"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/dsh-cli.ts","pathClass":"source","line":10,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"68a02d88ec9206b8db51fe36"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/gist.ts","pathClass":"source","line":23,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f4aae832714fcf2a438ab47c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/restart.ts","pathClass":"source","line":12,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1ef327e3a97e753d03add69e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/restart.ts","pathClass":"source","line":220,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1ef327e3a97e753d03add69e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/dsh-cli.spec.ts","pathClass":"test-example-docs","line":127,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"8c21c24e8058110558fe8f60"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/dsh-cli.spec.ts","pathClass":"test-example-docs","line":148,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"8c21c24e8058110558fe8f60"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/gist.spec.ts","pathClass":"test-example-docs","line":16,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"527f1adf7d0d73f200156cf2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/pnpm-behavior.compat.spec.ts","pathClass":"test-example-docs","line":13,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"9d6d90a5b9b628e7b16daa3e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/pnpm-behavior.compat.spec.ts","pathClass":"test-example-docs","line":13,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"a9c0d880f237deb503fc2449"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/provision.spec.ts","pathClass":"test-example-docs","line":13,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"bb0d401ebc3f6bce54156909"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/restart-helper.spec.ts","pathClass":"test-example-docs","line":16,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"4f44f72186e6f7ce15c459c6"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/web/registry.ts","pathClass":"test-example-docs","line":19,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"589fbd39d3c3dd27c4c0d39d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/web/registry.ts","pathClass":"test-example-docs","line":19,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"96d60bd2c2f99d91051addc5"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/web/scaffold.ts","pathClass":"test-example-docs","line":12,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"44d7d10783f5c400f4f89a23"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/web/scaffold.ts","pathClass":"test-example-docs","line":12,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"729a53ed304ea8e81876e095"}],"counts":{"critical":0,"high":0,"medium":0,"low":7},"rawCounts":{"critical":0,"high":0,"medium":7,"low":18},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":144,"bytesScanned":3053651,"truncated":false,"lockfiles":["pnpm-lock.yaml","package-lock.json"],"pathClasses":{"test-example-docs":78,"markdown":4,"source":54,"cordis":1,"data":5,"manifest":1,"yaml":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:19:36.841Z","commit":"b9323cc85d0148013384a5aca5215be1922eea36","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:17:21.935Z","commit":"f2172056fd25f4665de9b44a1983a7297f6de927","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:44:34.301Z","commit":"f2172056fd25f4665de9b44a1983a7297f6de927","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"b9323cc85d0148013384a5aca5215be1922eea36","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:19:36.841Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"f2172056fd25f4665de9b44a1983a7297f6de927","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:17:21.935Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"f2172056fd25f4665de9b44a1983a7297f6de927","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:44:34.301Z"}]}