dsh-poison-guard

Pre-install supply-chain poison scanner for DeepSeek Harness plugins — AST (JS-X-Ray) + deobfuscation + regex heuristics, not a toy grep.

dsh plugin add dsh-poison-guard npm install -g dsh-poison-guard

Malicious sample

MALICIOUS

install-script/dynamic-eval · package.json
"postinstall" runs dynamic code execution

ast/unsafe-import · index.js
obfuscated / untraceable import

exfil-combo
reads credentials AND makes network requests — the classic exfiltration shape

exfil-keys · index.js
touches SSH/AWS/GPG private-key paths

Benign sample

CLEAN

No obvious poisoning signature found.
Static scan is not a guarantee.

files: 2 · source files: 1 · AST warnings: 0 · decoded fragments: 0

What it detects

Severity	Examples
HIGH	data-exfiltration, unsafe-import, unsafe-stmt (eval/Function/vm), unsafe-command, deobfuscated-secret/key/command, exfil-combo, private-key paths
MEDIUM	serialize-environment, shady-link, sql-injection, monkey-patch, prototype-pollution, deobfuscated-url, network egress, install-time scripts
LOW	encoded-literal, short-identifiers, unsafe-regex, weak crypto, env-read, base64 obfuscation

Honest threat model: no static tool catches all poisoning — detecting arbitrary malicious behavior is undecidable (Rice's theorem). This makes the cheap, high-volume attacks visible. The real boundary is the DSH sandbox: keep untrusted plugins in workspace-write, never danger-full-access.

GitHub · npm