{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"flymysql-dsh-remote","slug":"flymysql-dsh-remote","rank":132,"url":"https://github.com/flymysql/dsh-remote","name":"flymysql/dsh-remote","category":"tools","description":{"zh":"多机远程工作区：管理多台 SSH 主机，在原生「添加工作区」流程里选本机系统文件夹或远程目录，把远程工作区镜像成真实本地文件夹并用 rw_* 工具操作。选择器是居中弹窗，默认落在本机页签，远程路径自动预填 `/` 并逐级自动补全目录。","en":"Multi-machine remote workspace: manage many SSH hosts, pick a local or remote workspace in the native Add-workspace flow (system folder chooser / local path / remote dir browse), mirror a remote workspace to a real local folder, and operate it with rw_* tools. The picker is a centered modal that opens on the local tab and auto-fills `/` for remote paths, live-completing each directory level."},"stars":31,"starsCheckedAt":"2026-08-21","repository":{"owner":"flymysql","repo":"dsh-remote","requestedRef":null,"subpath":""},"npm":"dsh-remote","downloads":2248,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-remote","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/flymysql/dsh-remote/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"flymysql-dsh-remote","slug":"flymysql-dsh-remote","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:21:16.808Z","scanStatus":"static-complete","verdict":"caution","score":93,"commit":"90d3cd2544661bf056abf08f9987b8d3b612d410","commitDate":"2026-08-21T18:58:24+08:00","artifactDigest":"sha256:0064214bf97c908ed43efd1abd92780feb91a11a5fb0c5899e3032e1a8e73cc8","downloadUrl":"https://github.com/flymysql/dsh-remote/archive/90d3cd2544661bf056abf08f9987b8d3b612d410.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-remote","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-remote","packageVersion":"0.8.7","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-workspace"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-commands","@deepseek-ai/dsh-host-webserver","@deepseek-ai/dsh-tools","@deepseek-ai/dsh-system-prompt","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-workspace","@deepseek-ai/cordis"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-remote","manifestName":"dsh-remote","nameMatch":true,"npm":{"name":"dsh-remote","latestVersion":"0.8.6","publishedAt":"2026-08-21T04:22:05.846Z","createdAt":"2026-08-14T04:29:35.533Z","versionCount":44,"maintainers":1,"repository":"git+https://github.com/flymysql/dsh-remote.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-remote","name":"dsh-remote","path":"cordis.patch.yml","disabled":false},{"id":"dsh-remote-sidebar","name":"dsh-better-sidebar","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":1,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","network","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"low","confidence":"high","layer":"dsh-semantics","path":"cordis.patch.yml","pathClass":"cordis","line":38,"evidence":"!!js >-","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","hash":"045521f7f7f047feef5ce477"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/credential.js","pathClass":"source","line":13,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"c146e6299bfa44cc8dd18edb"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":24,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"89dedaa9e6429e9e52b8af60"},{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"medium","confidence":"high","layer":"static","path":"lib/update.js","pathClass":"source","line":114,"evidence":"Buffer.from(await res.arrayBuffer()) // npm tarballs are gzipped tar; extract the package/ directory. const { gunzipSync } = await import(","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行","hash":"e24bde3b6871aad554e912db","review":{"verdict":"functional","reason":"该 gunzipSync/parseTar 逻辑是从官方 registry.npmjs.org 按包名+版本号拉取自身 tarball 并解压到临时目录以实现插件自更新，属正常自升级流程而非隐藏载荷，解压后仅 writeFileSync 落盘、还会校验 package.json 版本号一致，未见立即 eval/exec 解码内容。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:20:27.997Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":3},"rawCounts":{"critical":0,"high":0,"medium":1,"low":3},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":39,"bytesScanned":494251,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":10,"markdown":8,"source":15,"cordis":1,"data":1,"manifest":1,"script":3}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:21:16.808Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:21:16.808Z","commit":"90d3cd2544661bf056abf08f9987b8d3b612d410","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:20:27.997Z","commit":"90d3cd2544661bf056abf08f9987b8d3b612d410","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:48:18.248Z","commit":"8a5c703c6b45c2c0f6b180f5ca7eb17a340b5cfb","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"90d3cd2544661bf056abf08f9987b8d3b612d410","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:21:16.808Z"},{"kind":"verdict-change","from":"review","to":"caution","commit":"90d3cd2544661bf056abf08f9987b8d3b612d410","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:20:27.997Z"},{"kind":"first-scan","from":null,"to":"review","commit":"8a5c703c6b45c2c0f6b180f5ca7eb17a340b5cfb","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:48:18.248Z"}]}