rand0wn/dsh-malware-audit ↗★ 0
dsh-malware-audit
DSH 插件：基于 AST 真实扫描已安装插件的恶意意图模式，支持定时扫描与自动隔离。
AI 分析
核心用途是审计和检测 DSH 插件生态中的潜在恶意代码。适合安装了较多第三方插件、需要保障运行环境安全的用户。
安装
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:rand0wn/dsh-malware-audit说明文档
阅读完整 README ↗Usage
Type /scan-plugins in any session. It scans every other installed
package that declares dsh.bundle in its own package.json — the same
marker the plugin ecosystem's own registries use to mean "this is a dsh
plugin" — across every local profile, prints a findings summary, and saves
the full report to .dsh-malware-audit/scan-.txt under the
current working directory.
By default this is entirely read-only and manual. Two things make it more active, both opt-in and off unless you configure them:
scheduleMinutes— runs the same scan automatically on an interval, no command needed.autoQuarantine— on a scan (scheduled or manual) that finds a critical-severity pattern, automatically quarantines that plugin.
Configuration