{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"whatsmore-nf-dsh-pdf-edit","slug":"whatsmore-nf-dsh-pdf-edit","rank":658,"url":"https://github.com/Whatsmore-nf/dsh-pdf-edit","name":"Whatsmore-nf/dsh-pdf-edit","category":"docs","description":{"zh":"面向 PDF 文档的编辑插件,精确编辑PDF文字","en":"PDF document editing plugin for precise text editing in PDF files."},"stars":4,"starsCheckedAt":"2026-08-21","repository":{"owner":"Whatsmore-nf","repo":"dsh-pdf-edit","requestedRef":null,"subpath":""},"npm":"dsh-pdf-edit","downloads":0,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-pdf-edit","tarball":null,"added":"2026-08-21","page":"https://awesome-dsh-plugin.com/p/Whatsmore-nf/dsh-pdf-edit/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"whatsmore-nf-dsh-pdf-edit","slug":"whatsmore-nf-dsh-pdf-edit","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:27:14.474Z","scanStatus":"static-complete","verdict":"review","score":84,"commit":"265dc8cafc0ace48cb2861553c0f699711f5e2d1","commitDate":"2026-08-22T09:21:41+08:00","artifactDigest":"sha256:d3e00cf096e747f9324e0099336f12c344f222b26760f2b8582733fe5da3d03a","downloadUrl":"https://github.com/Whatsmore-nf/dsh-pdf-edit/archive/265dc8cafc0ace48cb2861553c0f699711f5e2d1.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-pdf-edit","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-pdf-edit","packageVersion":"0.1.7","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-tools"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-pdf-edit","manifestName":"dsh-pdf-edit","nameMatch":true,"npm":{"name":"dsh-pdf-edit","latestVersion":"0.1.5","publishedAt":"2026-08-21T04:56:45.760Z","createdAt":"2026-08-21T04:56:45.442Z","versionCount":1,"maintainers":1,"repository":"git+https://github.com/Whatsmore-nf/dsh-pdf-edit.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"pdf-edit","name":"dsh-pdf-edit","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","credentials","environment","filesystem","host-bundle","network","subprocess","telemetry"],"outboundHosts":[{"host":"api.deepseek.com","count":1}],"findings":[{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"package-lock.json","pathClass":"manifest","line":1,"evidence":"extract-zip@2.0.1 GHSA-jmr9-qjv8-65gv (CVE-2026-56876)","remediation":"关注 GHSA-jmr9-qjv8-65gv 的修复进展，并评估该依赖是否可移除。","layer":"vulnerability","hash":"207f515438d5c4183c1b6fc0","review":{"verdict":"unclear","reason":"提供的package-lock.json片段仅显示到@napi-rs/canvas条目，未展示extract-zip@2.0.1的实际锁定项，无法核实该漏洞依赖是否真实存在于依赖树及其触发路径（推测经由可选依赖puppeteer-core引入）。","model":"sonnet","reviewedAt":"2026-08-21T10:58:01.690Z"}}],"counts":{"critical":0,"high":1,"medium":0,"low":0},"rawCounts":{"critical":0,"high":1,"medium":0,"low":0},"vulnerabilities":[{"id":"GHSA-jmr9-qjv8-65gv","aliases":["CVE-2026-56876"],"package":"extract-zip","version":"2.0.1","severity":"high","fixed":null,"summary":"extract-zip unvalidated symlink path traversal"}],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":58,"bytesScanned":381858,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"markdown":2,"cordis":1,"data":2,"manifest":1,"source":21,"test-example-docs":31}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:27:14.474Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:27:14.474Z","commit":"265dc8cafc0ace48cb2861553c0f699711f5e2d1","policyVersion":"HT-DSH-0.2.2","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:28:54.730Z","commit":"c5110071c233e616c223b722b0122121a0020736","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T10:58:01.690Z","commit":"c5110071c233e616c223b722b0122121a0020736","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"265dc8cafc0ace48cb2861553c0f699711f5e2d1","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:27:14.474Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"c5110071c233e616c223b722b0122121a0020736","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:28:54.730Z"},{"kind":"first-scan","from":null,"to":"review","commit":"c5110071c233e616c223b722b0122121a0020736","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:58:01.690Z"}]}