{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"slywalker2006-dsh-passwords","slug":"slywalker2006-dsh-passwords","rank":191,"url":"https://github.com/slywalker2006/dsh-passwords","name":"slywalker2006/dsh-passwords","category":"security","description":{"zh":"让 DeepSeek Harness 变成服务器级多租户平台：远程访问 + 自动 HTTPS、子用户权限与配额、沙盒强制、加密认证与审计日志。","en":"Turns DeepSeek Harness into a server-grade multi-tenant platform: remote access + auto HTTPS, subuser permissions & token/daily quotas, sandbox enforcement, encrypted auth & audit log."},"stars":18,"starsCheckedAt":"2026-08-21","repository":{"owner":"slywalker2006","repo":"dsh-passwords","requestedRef":null,"subpath":""},"npm":"dsh-passwords","downloads":2456,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-passwords","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/slywalker2006/dsh-passwords/","screenshots":["https://raw.githubusercontent.com/slywalker2006/dsh-passwords/main/docs/screenshots/white-login.png","https://raw.githubusercontent.com/slywalker2006/dsh-passwords/main/docs/screenshots/black-login.png","https://raw.githubusercontent.com/slywalker2006/dsh-passwords/main/docs/screenshots/white-login-en.png","https://raw.githubusercontent.com/slywalker2006/dsh-passwords/main/docs/screenshots/main-ui.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"slywalker2006-dsh-passwords","slug":"slywalker2006-dsh-passwords","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:22:04.358Z","scanStatus":"static-complete","verdict":"pass","score":99,"commit":"1024a755c9ae288360af9602d31f0178f262adaf","commitDate":"2026-08-22T13:57:20+08:00","artifactDigest":"sha256:3f14f267087f610b805da78d4816795117df25fe2492d4f8460631acaa786017","downloadUrl":"https://github.com/slywalker2006/dsh-passwords/archive/1024a755c9ae288360af9602d31f0178f262adaf.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-passwords","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-passwords","packageVersion":"2.6.0","bundle":{"patch":"./cordis.yml"},"client":{"platform":"web"},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-passwords","manifestName":"dsh-passwords","nameMatch":true,"npm":{"name":"dsh-passwords","latestVersion":"2.5.4","publishedAt":"2026-08-20T14:43:20.737Z","createdAt":"2026-08-15T13:37:15.282Z","versionCount":16,"maintainers":1,"repository":"git+https://github.com/slywalker2006/dsh-passwords.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.yml","inserts":[{"id":"directory-picker-browse","name":"@deepseek-ai/dsh-host-directory-picker-browse","path":"cordis.yml","disabled":false},{"id":"ui-directory-picker-browse","name":"@deepseek-ai/dsh-client-ui-directory-picker-browse","path":"cordis.yml","disabled":false},{"id":"dsh-passwords","name":"dsh-passwords","path":"cordis.yml","disabled":false}],"overrides":[{"id":"directory-picker","tier":"normal","mode":"override","disabled":true,"replacesImplementation":false,"name":null,"keys":[],"path":"cordis.yml"}],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","subprocess"],"outboundHosts":[{"host":"deb.nodesource.com","count":1},{"host":"acme-v02.api.letsencrypt.org","count":1},{"host":"acme-staging-v02.api.letsencrypt.org","count":1},{"host":"api.ipify.org","count":1},{"host":"ifconfig.me","count":1},{"host":"icanhazip.com","count":1},{"host":"evil.com","count":1},{"host":"api.github.com","count":1}],"findings":[{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"install.sh","pathClass":"script","line":5,"evidence":"curl 直接装: curl -fsSL https://raw.githubusercontent.com/slywalker2006/dsh-passwords/main/install.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","hash":"bf0c45bd495fd0f631364c10","review":{"verdict":"placeholder","reason":"install.sh:5 位于注释块内（# 用法说明），仅是给用户展示的一键安装命令文本，脚本本身并未执行该 curl|bash 语句。","model":"sonnet","reviewedAt":"2026-08-21T10:50:04.440Z"}},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"install.sh","pathClass":"script","line":24,"evidence":"curl | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","hash":"0c3d27b1caf6fd2eab65db0e","review":{"verdict":"placeholder","reason":"install.sh:11 同样是注释，解释 curl|bash 场景下 BASH_SOURCE 不可靠的原因，非可执行代码，实际逻辑走 git clone + 本地 node 脚本。","model":"sonnet","reviewedAt":"2026-08-21T10:50:04.440Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/install.mjs","pathClass":"source","line":8,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"e004f1996d4f72ee9fe233f1"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/install.mjs","pathClass":"source","line":8,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f30b18b69b622d7dd6c7e2b5"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/register-plugin.mjs","pathClass":"source","line":18,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"3e23d59896a15b8119377502"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/register-plugin.mjs","pathClass":"source","line":18,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7b29ba3a1c66e3d617d70fad"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/start-http.mjs","pathClass":"source","line":12,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f345dc0861e359aa7555e1a7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/cli.ts","pathClass":"source","line":19,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"c634a01f8d04470446ed90b5"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/cli.ts","pathClass":"source","line":19,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"93b630cc391cd66bd8db8ef7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/config.ts","pathClass":"source","line":9,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"261a772358fe9ac654fbd2e0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/config.ts","pathClass":"source","line":9,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0d8331b5c6ae301969dd5149"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/patch.ts","pathClass":"source","line":18,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"15a682939fe34caab9330fd3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/patch.ts","pathClass":"source","line":18,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"9dcc45e6d201e2c4a2b07f1b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/plugin.ts","pathClass":"source","line":21,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"2d057d8f85158d842eaece9e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/update.ts","pathClass":"source","line":35,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a674bd4ebfe555dfa2102efb"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/update.ts","pathClass":"source","line":35,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ee8551807b78a8081e99ee2e"}],"counts":{"critical":0,"high":0,"medium":0,"low":14},"rawCounts":{"critical":2,"high":0,"medium":0,"low":14},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":37,"bytesScanned":765977,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"markdown":2,"cordis":1,"yaml":2,"script":3,"data":2,"manifest":1,"source":26}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:22:04.359Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:22:04.358Z","commit":"1024a755c9ae288360af9602d31f0178f262adaf","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:21:51.237Z","commit":"12654edc6a0371b53d0ed24db065cc26a87f9eee","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:50:04.440Z","commit":"12654edc6a0371b53d0ed24db065cc26a87f9eee","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"1024a755c9ae288360af9602d31f0178f262adaf","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:22:04.358Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"12654edc6a0371b53d0ed24db065cc26a87f9eee","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:21:51.237Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"12654edc6a0371b53d0ed24db065cc26a87f9eee","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:50:04.440Z"}]}