dsh-crew

检测报告

能力清单

• 可执行外部程序spawns-processes高关注14 处命中
  • src/dsh-cli-runtime.mjs:8import { spawnSync } from 'node:child_process';
  • src/install/install-legacy.mjs:8import { spawnSync } from 'node:child_process';
  • src/install/npx-lifecycle.mjs:24import { spawnSync } from 'node:child_process';
  • src/official-web-bridge.mjs:1import { spawn } from 'node:child_process';
  • 看它调用哪些程序。调用本机已有的工具是常见做法。
• 以 shell 执行命令shell-exec高关注3 处命中
  • src/orchestrator.mjs:27return execFileSync('powershell.exe', [
  • src/orchestrator.mjs:35return execFileSync('ps', ['-o', 'comm=', '-p', String(pid)], options);
  • src/process-identity.mjs:52const out = execFileSync('powershell.exe', [
  • 看命令字符串是拼出来的还是写死的。拼接用户输入才是真正的风险。
• R010 向其他插件注入plugin-tree-injection高关注1 处命中
  • @ran-sh/dsh-crew
  • 看 patch 里 insert 的包是不是本项目自己的。插入第三方代码要格外留意。
• R012 改写用户 profileprofile-tamper高关注1 处命中
  • verify-official-bridge-e2e.mjs
  • 看它改的是自己那一段还是别人的。改用户 profile 通常应由用户手动做。
• 写入文件writes-files需留意303 处命中
  • src/history/archive-store.mjs:60mkdirSync(dirname(file), { recursive: true });
  • src/history/archive-store.mjs:65fd = openSync(temporary, 'wx', 0o600); writeFileSync(fd, bytes); fsyncSync(fd); closeSync(fd); fd = undefined;
  • src/history/archive-store.mjs:69} else renameSync(temporary, file);
  • src/history/archive-store.mjs:72if (existsSync(temporary)) unlinkSync(temporary);
  • 看写入位置。写自己的配置目录是正常的，写系统目录不是。
• 发起网络请求network需留意25 处命中
  • lib/client.js:672const res = await fetch(API$1 + action, {
  • lib/client.js:2225const get = (0, react.useCallback)(async (path, timeoutMs = 8e3) => readJson(await fetch(withLang(path), {
  • lib/client.js:2229const post = (0, react.useCallback)(async (path, body) => readJson(await fetch(withLang(path), {
  • lib/client.js:2244const response = await fetch(`${API}${path}`, { cache: "no-store" });
  • 看请求发往哪些域名。发往作者自己的后端是常见做法。
• 可终止进程kills-processes需留意13 处命中
  • src/install/install-legacy.mjs:835try { process.kill(-pid, 'SIGKILL'); return true; } catch { /* fall through to the single pid */ }
  • src/install/install-legacy.mjs:836try { process.kill(pid, 'SIGKILL'); return true; } catch { return false; }
  • src/install/npx-lifecycle.mjs:287process.kill(pid, 0);
  • src/official-web-bridge.mjs:98killImpl = (pid) => process.kill(pid),
  • 看它终止的是自己启动的进程，还是按名字匹配到的任意进程。
• 运行时改写自身配置modifies-own-manifest需留意4 处命中
  • scripts/live-policy-matrix.mjs:39writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name: 'dsh-crew-live-fixture', private: true, type: 'modu…
  • src/install/npx-lifecycle.mjs:1120writeFileSync(join(stageDir, 'package.json'), JSON.stringify(stagedManifest, null, 2) + '\n');
  • …s/verify-official-bridge-e2e.mjs:111writeFileSync(join(profileRoot, 'package.json'), JSON.stringify({
  • …s/verify-official-bridge-e2e.mjs:117writeFileSync(join(profileRoot, 'cordis.patch.yml'), '[]\n');
  • 运行时改写自身配置会让下次启动的行为和你看过的源码不一致。
• 启动伪终端spawns-pty需留意3 处命中
  • src/orchestrator.mjs:27return execFileSync('powershell.exe', [
  • src/process-identity.mjs:52const out = execFileSync('powershell.exe', [
  • …s/verify-official-bridge-e2e.mjs:106spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', command], { windowsHide: true });
  • 伪终端等于给了一个完整 shell。确认这是插件的核心功能。
• 接触凭据或密钥credentials一般542 处命中
  • lib/client.js:217/** Project only structured, non-secret installer/runtime evidence. */
  • lib/client.js:459* of underlying model turns. No prompts, results, credentials, or new
  • lib/client.js:1321credentialReferences: "Credential 引用",
  • lib/client.js:1322credentialReferenceHint: "仅显示引用名、归属和孤儿状态；不会读取或删除密钥。",
  • 看它读取哪些凭据、发往哪里。用于登录自己的服务是正常的。
• 读取文件reads-files一般439 处命中
  • src/history/archive-store.mjs:53const bytes = readFileSync(file);
  • src/history/archive-store.mjs:72if (existsSync(temporary)) unlinkSync(temporary);
  • src/history/archive-store.mjs:138try { projects = readdirSync(sessionsRoot, { withFileTypes: true }); } catch { return new Set(); }
  • src/history/archive-store.mjs:144try { entries = readdirSync(join(sessionsRoot, project.name), { withFileTypes: true }); } catch { continue; }
  • 读文件是绝大多数插件的正常工作方式，本身不构成顾虑。
• 读取环境变量reads-env一般70 处命中
  • src/install/crew-skill.mjs:29export function crewSkillRoots({ home = homedir(), env = process.env } = {}) {
  • src/install/crew-skill.mjs:40export function crewSkillFiles({ home = homedir(), env = process.env } = {}) {
  • src/install/crew-skill.mjs:58export function installCrewSkill({ home = homedir(), root, env = process.env } = {}) {
  • src/install/crew-skill.mjs:83export function removeCrewSkill({ home = homedir(), env = process.env } = {}) {
  • 环境变量里常混有密钥。看它是否把整个 env 都读走。
• 动态加载模块dynamic-import一般22 处命中
  • src/dsh-cli-runtime.mjs:1039// resolution a require() from that directory would take.
  • bin/dsh-crew.mjs:13const { runProductionHistory } = await import('../src/history/runner.mjs');
  • src/hub/index.mjs:1441const { readGlobalConfig } = await import('../install/install.mjs');
  • src/hub/index.mjs:1450const { registerRuntimeHistory } = await import('../history/runtime.mjs');
  • 动态导入本身无害，但会让依赖关系难以静态审阅。

这份报告的口径

扫描读的是包里的源码，全程不执行第三方代码。 本次读了 161 个文件，扫描于 2026-10-14。 命中次数只说明源码里出现过这类调用，不说明行为好坏——一个插件读写文件 500 次和 1 次 都会被记为「读取文件」。这是能力清单，不是信任评分，也不是安全结论： 没扫出来的能力可能只是写法没被规则覆盖。

依赖安全公告