github.com / T-Auto

T-Auto/dsh-ops

JavaScript·632 files·commit 61ef553·scanned 1d ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 4,599 stars — findings likely legitimate code patterns

verdict accurate?

Created 20 days ago

Crypto/Web3 project

Created 20 days ago

Partial architecture graph

CLI tool detected

threat-state: lowlive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.native/darwin-metadata/src/lib.rs

    // a valid live fd. A successful non-null ACL is released exactly once.
    let acl = unsafe { *__error() = 0; acl_get_fd_np(file.as_raw_fd(), ACL_TYPE_EXTENDED) };
    if acl.is_null() {
        ...

    // SAFETY: total scalar conversion, no pointer arguments.
    io::Error::from_raw_os_error(unsafe { RtlNtStatusToDosError(status) } as i32)
}
fn info() -> Info {

criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.src/profile-install.ts

  if (process.platform === 'win32' && /\.(cmd|bat)$/i.test(command)) {
    result = spawnSync(process.env.ComSpec ?? 'cmd.exe', ['/d', '/s', '/c', `""${command}" ${args.join(' ')}"`], { stdio: 'inheri...

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.test/bench-panel.test.mjs

    assert.ok(script.includes('textContent'), 'the runtime writes values with textContent')
    new Function(script) // throws on a syntax error in the inline runtime
  })
})

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.test/ops-panel-collect.test.mjs

    // ... and the viewer has no sink that could turn text into markup.
    for (const sink of ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'document.write', 'eval(', 'new Function']) {
      asse...

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.test/credential-fence.test.mjs

 * - `DSH_OPS_DENY_READ` only ever *widens* the fence, which is what lets these cases run without
 *   touching the operator's real `~/.ssh`.
 * - A directory holding one binary file is no longer an i...

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.test/docx-host.test.mjs

  fs.writeFileSync(path.join(root, 'body.docx'), docx(paragraph('readonly')))
  fs.writeFileSync(path.join(root, 'id_ed25519.docx'), docx(paragraph('SECRET')))
  fs.writeFileSync(path.join(root, 'old....

warningSSH/credential path accessAccessing .ssh, .aws/credentials, or .env files to steal authentication credentials.test/pdf-host.test.mjs

  fs.writeFileSync(path.join(root, 'text.pdf'), textPdf([show('readonly')]))
  fs.writeFileSync(path.join(root, 'id_ed25519.pdf'), textPdf([show('SECRET')]))
  fs.writeFileSync(path.join(root, 'broken...

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.bench/compare.mjs+3

infoSuspicious file in repoExecutable file (prepare-workspace.ps1) in repositorybin/prepare-workspace.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

494 files scanned @ 61ef553 | 10/28/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access20

obfuscation3

supply chain2

owasp / injection0

telemetry

files 494/632rules hit 11engine v7commit 61ef553

github

T-Auto/dsh-ops

A toolkit for low-level operations in DSH, designed to reduce token usage and task execution time / DSH 底层操作工具插件，旨在减少 Token 消耗与任务耗时

JavaScript

4599

138

22d

632 files

494 scanned(78%)

61ef553

architecture░▒▓

entry (2) flagged (10) pkg (95)

495 nodes · 1213 edgesscroll to zoom · click node to jump to finding