{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"truelove-dreamer-dsh-plugin-vetting","slug":"truelove-dreamer-dsh-plugin-vetting","rank":554,"url":"https://github.com/truelove-dreamer/dsh-plugin-vetting","name":"truelove-dreamer/dsh-plugin-vetting","category":"security","description":{"zh":"为了您的电脑安全，装插件前先体检：静态扫描恶意模式（外传/凭据/混淆/持久化）与高权限误用，覆盖传递依赖与官方包哈希基线（防供应链篡改），可选插件工具调用闸。","en":"Vets third-party plugins before you trust them: static scan for malicious patterns (exfiltration, credential access, obfuscation, persistence) and over-privileged path use, transitive-dependency coverage, official-package hash baseline for supply-chain tamper detection, and an optional plugin-tool call gate."},"stars":4,"starsCheckedAt":"2026-08-21","repository":{"owner":"truelove-dreamer","repo":"dsh-plugin-vetting","requestedRef":null,"subpath":""},"npm":"dsh-plugin-vetting","downloads":2475,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-plugin-vetting","tarball":null,"added":"2026-08-15","page":"https://awesome-dsh-plugin.com/p/truelove-dreamer/dsh-plugin-vetting/","screenshots":["https://raw.githubusercontent.com/truelove-dreamer/dsh-plugin-vetting/main/assets/shot-report.png","https://raw.githubusercontent.com/truelove-dreamer/dsh-plugin-vetting/main/assets/shot-detail.png","https://raw.githubusercontent.com/truelove-dreamer/dsh-plugin-vetting/main/assets/shot-gate.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"truelove-dreamer-dsh-plugin-vetting","slug":"truelove-dreamer-dsh-plugin-vetting","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:26:07.037Z","scanStatus":"static-complete","verdict":"caution","score":95,"commit":"aa92e5aa71574cbd760f5b61bda40163f64de591","commitDate":"2026-08-17T10:14:57+08:00","artifactDigest":"sha256:32d86c128f13f7f9bd611f502dadd9f57ebe25dfea89d7d5bab0eed0e742c5d3","downloadUrl":"https://github.com/truelove-dreamer/dsh-plugin-vetting/archive/aa92e5aa71574cbd760f5b61bda40163f64de591.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-plugin-vetting","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-plugin-vetting","packageVersion":"0.5.6","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-plugin-vetting","manifestName":"dsh-plugin-vetting","nameMatch":true,"npm":{"name":"dsh-plugin-vetting","latestVersion":"0.5.6","publishedAt":"2026-08-16T05:54:06.714Z","createdAt":"2026-08-15T02:51:16.365Z","versionCount":9,"maintainers":1,"repository":"git+https://github.com/truelove-dreamer/dsh-plugin-vetting.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"plugin-vet","name":"dsh-plugin-vetting","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["environment","filesystem","host-bundle","network","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/gate.js","pathClass":"source","line":13,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"2667a075c20470f97ee319d5"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":18,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"347addbba75485af13ffa571"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":36,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"347addbba75485af13ffa571"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"medium","confidence":"medium","layer":"static","path":"lib/rules.js","pathClass":"source","line":31,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"命令由运行时变量拼接，需确认输入来源是否可信","hash":"d7801c8b34d805e527d6f57c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/scan.js","pathClass":"source","line":230,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"37eb1543e5b37fb843300e4f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/scan.test.mjs","pathClass":"test-example-docs","line":62,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"439671bb3f31604df369915f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/scan.test.mjs","pathClass":"test-example-docs","line":62,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"ac31fed3f32e698c7cca7322"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"test/scan.test.mjs","pathClass":"test-example-docs","line":160,"evidence":"curl \", \"evil.example | sh","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命令位于字符串字面量中，执行路径需人工确认；位于测试、示例或文档目录","hash":"a12e3689ffc8bd7218fa87b7"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"critical","confidence":"low","layer":"static","path":"test/scan.test.mjs","pathClass":"test-example-docs","line":81,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式；位于测试、示例或文档目录","hash":"aa2b01966431173fe1eac8c3"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/scan.test.mjs","pathClass":"test-example-docs","line":146,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中；位于测试、示例或文档目录","hash":"aa2b01966431173fe1eac8c3"}],"counts":{"critical":0,"high":0,"medium":1,"low":4},"rawCounts":{"critical":2,"high":1,"medium":1,"low":6},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":12,"bytesScanned":65904,"truncated":false,"lockfiles":[],"pathClasses":{"test-example-docs":4,"markdown":1,"cordis":1,"source":4,"script":1,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:26:07.037Z","commit":"aa92e5aa71574cbd760f5b61bda40163f64de591","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:27:28.693Z","commit":"aa92e5aa71574cbd760f5b61bda40163f64de591","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:56:26.953Z","commit":"aa92e5aa71574cbd760f5b61bda40163f64de591","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"aa92e5aa71574cbd760f5b61bda40163f64de591","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:26:07.037Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"aa92e5aa71574cbd760f5b61bda40163f64de591","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:27:28.693Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"aa92e5aa71574cbd760f5b61bda40163f64de591","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:56:26.953Z"}]}