dsh-plugin-inspector

Usage

dsh-inspect  [options]
dsh-inspect --from-npm [@] [options]

                  A plugin directory, or an npm tarball (.tgz / .tar.gz).

Options
  --from-npm        Fetch a published package from the registry, verify its
                          dist.integrity hash, and analyse it in memory.
  --registry         Registry base URL for --from-npm.
                          (default: https://registry.npmjs.org)
  --json                  Emit the machine-readable JSON document on stdout.
  --fail-on     Exit 1 at or above this severity.
                          critical | high | medium | low | none    (default: high)
  --no-color              Plain text, no ANSI.
  --version, --help

Exit codes, which are the CI contract:

Code	Meaning
0	Analysis completed; nothing at or above --fail-on
1	Analysis completed; at least one finding at or above --fail-on
2	Analysis could not be performed

2 is deliberately distinct from 1. A job that cannot tell "the analyzer broke" from "the plugin is clean" is the failure this split exists to prevent.

Getting a package without installing it

Never pnpm add a package you have not read.