github.com / chromoany

chromoany/dsh-notify-me

JavaScript·63 files·commit 1e61d3d·scanned 17h ago·cached ✓

8/100

SAFE

No malicious patterns found. Repo signals are consistent with a legitimate project.

verdict accurate?

threat-state: safelive

FINDINGS ░▒▓

warningVM code executionvm.runInNewContext or similar can execute arbitrary code in a sandboxed context that may be escaped.smoke/cordis-host-test.mjs

  vm.createContext(sandbox);
  vm.runInContext(SRC, sandbox, { filename: 'client.js' });
  if (!captured.reg) throw new Error('plugin did not register via __ModuleLoader__.load');
  const events = [];

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoSuspicious file in repoExecutable file (focus-window.ps1) in repositorylib/focus-window.ps1+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

12 files scanned @ 1e61d3d | 10/29/2026 | heuristic scan — always review manually

risk by category

code execution6

network & exfiltration0

file system access0

obfuscation0

supply chain2

owasp / injection0

telemetry

files 12/63rules hit 3engine v7commit 1e61d3d

github

chromoany/dsh-notify-me

DSH 桌面消息提醒插件 / desktop notification and message alerts for DeepSeek Harness web：需要你操作（可操作提醒）与回复完成提醒，系统通知+提示音+标签页标题，设置页开关 + 中英通知语言

JavaScript

51d

63 files

12 scanned(19%)

1e61d3d

architecture░▒▓

entry (1) flagged (1) pkg (1)

11 nodes · 6 edgesscroll to zoom · click node to jump to finding