dsh-plugin-inspector 0.2.1 → 0.3.0

package/README.md

@@ -13,15 +13,15 @@ $ dsh-inspect --from-npm some-dsh-plugin@1.4.0
 
 ## Install
 
-Node `^22.19.0 || >=24`. Once a release is published:
+Node `^22.19.0 || >=24`.
 
 ```console
 npm install -g dsh-plugin-inspector
 dsh-inspect --help
 ```
 
-Until then the binary comes from a checkout — and `lib/` is generated, so a fresh clone has no
-`dsh-inspect` until it is built:
+From a checkout instead — `lib/` is generated, so a fresh clone has no `dsh-inspect` until it is
+built:
 
 ```console
 git clone https://github.com/CharlotteN7/dsh-plugin-inspector
@@ -89,14 +89,14 @@ every `B13`.
 
 ## What it reports on the real ecosystem
 
-Measured **2026-08-16** against the 40 most-starred GitHub repositories tagged `dsh-plugin` that
-publish a resolvable npm package, each pinned to the version current that day. Re-run it with
-`pnpm run sweep`; the corpus is `scripts/ecosystem-corpus.json` and the recorded measurement is
-`tests/ecosystem-baseline.json`.
+Measured **2026-08-17** against the 40 most-starred GitHub repositories tagged `dsh-plugin` that
+publish a resolvable npm package, each pinned to the version it resolved to on 2026-08-16. Re-run
+it with `pnpm run sweep`; the corpus is `scripts/ecosystem-corpus.json` and the recorded
+measurement is `tests/ecosystem-baseline.json`.
 
 Both columns come from the same corpus and the same pinned versions, so the difference is this
-tool's doing and not the ecosystem's. "0.1" is the published `dsh-plugin-inspector@0.1.0`; "0.2" is
-this tree, which still reports version `0.1.0` because the release is not published yet.
+tool's doing and not the ecosystem's. "0.1" is `dsh-plugin-inspector@0.1.0`; "0.2" is this tree,
+which reports itself as `0.2.1` because it reads the version out of its own manifest.
 
 | | 0.1 | 0.2 |
 |---|---|---|
@@ -230,7 +230,7 @@ confidence `certain`.
 
 | id | Check | Severity | Method |
 |---|---|---|---|
-| A1 | Install lifecycle script (`preinstall`, `install`, `postinstall`, `prepare`, `prepublish`, `preprepare`, `postprepare`) | medium | `package.json.scripts` key set. `dsh plugin add` forwards to pnpm verbatim and adds no `--ignore-scripts`, but pnpm ≥ 10 blocks a dependency's lifecycle scripts by default until the package is listed under `allowBuilds`, and `apps/cli/src/plugin.ts` prints that instruction when a build is blocked. The script is one approval away from running, not already running |
+| A1 | Install lifecycle script (`preinstall`, `install`, `postinstall`, `prepare`, `prepublish`, `preprepare`, `postprepare`) | medium; **high** when the command itself fetches, decodes, pipes to a shell, or evaluates inline code | `package.json.scripts` key set. `dsh plugin add` forwards to pnpm verbatim and adds no `--ignore-scripts`, but pnpm ≥ 10 blocks a dependency's lifecycle scripts by default until the package is listed under `allowBuilds`, and `apps/cli/src/plugin.ts` prints that instruction when a build is blocked. The script is one approval away from running, not already running — which is why the category alone is `medium`, and why the measured 5 of 40 legitimate packages that declare one (`tsdown`, `npm run build`, `husky`, `node scripts/prepare.mjs`) stay there. The escalation reads the command line itself, and is calibrated to fire on none of them |
 | A2 | Patch row sets `disabled` **truthily** on a **security-relevant** core row (`approval`, `permission`, `sandbox`, `sandbox-policy`, `bash-sandbox`, `pwsh-sandbox`, `fs-sandbox`, `fs-observation-policy`, `subprocess`, `credentials`, `timeout-policy`, `spill-policy`, `session-persistence-jsonl`) | **critical** | patch YAML row with `id ∈ SECURITY_ROWS`. The loader coerces — `disabledOf` is `Boolean(options.disabled)` (`vendor/loader/src/config/entry.ts`) — so `null`, `0` and `""` leave the row **running** and are not this finding. A `!!js` node is an object and stays truthy, so an expression is judged by what it can evaluate to |
 | A3 | Patch row disables any other known core row | high for a `@deepseek-ai/dsh-base` row, medium for one only a surface bundle inserts | same, `id ∈ CORE_ROWS`. The row inventory records which of the three shipped bundles inserts each row, because they are not one profile: a `ui-*` row exists only where the web bundle is mounted. Suppressed entirely when the package under analysis *is* one of the three bundles — `@deepseek-ai/dsh-web-app` disabling two dozen rows `@deepseek-ai/dsh-base` inserted is what composing a surface bundle is |
 | A4 | Patch row carries a `name` that does not match the targeted row's `name` | medium | `applyEntryPatches` treats `name` on a non-insert patch as an **assertion guard**, not an override: on mismatch it warns and `continue`s, skipping the whole patch. So this row does nothing at all. Either the author is targeting a row that has been renamed, or the patch is stale — in both cases what the user reads and what mounts disagree |
@@ -277,15 +277,12 @@ readability finding fires.
 | id | Check | Severity | Method |
 |---|---|---|---|
 | B1 | Replaces a core capability seam — `ctx.provide(<seam>, …)` / `ctx.set(<seam>, …)` where `<seam>` is a key from `api-catalog.ts` | **critical** | call expression, literal first argument matched against the seam key set |
-| B2 | Auto-approves — a listener on `approval/request` that returns an approving verdict with no user interaction | **critical** | listener body return analysis |
-| B3 | `tools/pre-execute` listener returning `allow` | high | same |
-| B4 | Waterfall listener that never references `next` | high | The waterfall set is exactly 13 events: `agent/pre-step`, `agent/request`, `agent/request-error`, `approval/request`, `fs/edit-intent`, `fs/write-intent`, `llm/stream`, `session-telemetry/record`, `system-prompt/assemble`, `tools/code-dispatch-log`, `tools/execute`, `tools/post-execute`, `tools/pre-execute`. Per the harness's own rule, returning without calling `next()` short-circuits the chain **including the built-in behavior**, silently disabling the default for everyone downstream. Note there is **no** `fs/read-intent` — the intent family is write and edit only |
 | B5 | System-prompt mutation — `system-prompt/assemble` listener, or `ctx.systemPrompt.{section,context,variable,tools,suppressRuntimeContext}` | high | call matching |
 | B6 | Credential read — `process.env.*(TOKEN\|KEY\|SECRET\|PASSWORD\|CREDENTIAL)*`, `~/.dsh/credentials`, `~/.npmrc`, `~/.aws`, `~/.ssh`, `ctx.credentials.*` | medium alone | identifier + literal matching |
 | B7 | Network egress — `fetch`, `node:http(s).request`, `node:net`, `WebSocket`, `undici` | medium alone | import + call matching |
 | B8 | **Exfiltration pair** — B6 ∧ B7 in the same package | high | set intersection. Reported explicitly as *capability, not dataflow*: the tool cannot prove the credential value reaches the socket. `high` rather than critical because it fires on 18 % of published plugins |
 | B9 | Direct `node:child_process` / `node:worker_threads` / `node:vm` | medium alone, high paired with B8's two halves | import specifier. Bypasses `ctx.subprocess` and `ctx.sandbox` entirely. `medium` alone because a bare import fires on half the published ecosystem |
-| B10 | Prompt-injection heuristics on **model-visible text only** — registered tool `description` string literals, and shipped skill/instruction files | high | imperative-override phrasing, role reassignment, exfiltration instructions, hidden-text markers. Run on *exactly* the text that reaches the model, never on ordinary source comments |
+| B10 | Prompt-injection heuristics on **model-visible text only** — registered tool `description` string literals, and shipped skill/instruction files | high | imperative-override phrasing, role reassignment, exfiltration instructions, hidden-text markers — zero-width and bidirectional controls, the tag block, and runs of four or more variation selectors, the encoding GlassWorm shipped executable JavaScript in. Run on *exactly* the text that reaches the model, never on ordinary source comments |
 | B11 | Nested plugin mounting — `ctx.plugin(…)`, loader manipulation | high | call matching. A layer that mounts further layers moves the analysis target |
 | B12 | Dynamic code construction — `eval`, `new Function`, `vm.runInNewContext`, `module._load` | high | call matching |
 | B13 | Filesystem access outside `ctx.fs` — imports `node:fs` or `node:fs/promises` | medium | Reads and writes through the Node API are invisible to `fs/write-intent`, `fs/edit-intent`, `fs/observed`, and the `fs-sandbox` row, so no policy in the profile sees them and nothing appears in the session log |
@@ -378,7 +375,7 @@ would have burned the idea.
    is why it is `high` and not `critical`.
 7. **Injection phrasing that is not spelled in ASCII.** The injection heuristics are Latin-alphabet
    regexes. Substituting Cyrillic homoglyphs — `о` U+043E for `o`, `е` U+0435 for `e` — defeats
-   **every one of the ten rules**, including the zero-width-character rule, which looks for
+   **every one of the eleven rules**, including the two hidden-character rules, which look for
    invisible characters and not for visible ones that are the wrong letter. Verified against the
    rule table, not assumed. Normalisation is not in 0.2; do not read a clean `A21`/`B10` as
    evidence that shipped markdown carries no instructions.

package/lib/checks/tier-a.js

@@ -11,7 +11,7 @@
 import { isJsExpr } from "../cordis-yaml.js";
 import { boundedJson, lineColumn, normalizePackagePath, snippet } from "../files.js";
 import { scanInjection } from "../injection.js";
-import { CORE_ROWS, HARNESS_BUNDLE_PACKAGES, INSTALL_LIFECYCLE_SCRIPTS, MCP_CLIENT_PACKAGE, SECURITY_ROW_IDS, SECURITY_SEAM_KEYS, SEAM_KEYS, SKILL_FILESYSTEM_ROW, SKILL_ROOT_CONFIG_KEYS, } from "../knowledge.js";
+import { CORE_ROWS, HARNESS_BUNDLE_PACKAGES, INSTALL_LIFECYCLE_SCRIPTS, LIFECYCLE_SIGNALS, MCP_CLIENT_PACKAGE, SECURITY_ROW_IDS, SECURITY_SEAM_KEYS, SEAM_KEYS, SKILL_FILESYSTEM_ROW, SKILL_ROOT_CONFIG_KEYS, } from "../knowledge.js";
 import { declaredPackages } from "../manifest.js";
 /**
  * Checks that read a Cordis patch row. None of them may produce a finding
@@ -421,19 +421,26 @@ function checkManifest(input) {
     const { manifest, source } = input;
     const lifecycle = INSTALL_LIFECYCLE_SCRIPTS.filter(name => name in manifest.scripts);
     for (const name of lifecycle) {
+        const command = manifest.scripts[name] ?? '';
+        const signals = LIFECYCLE_SIGNALS.filter(signal => signal.pattern.test(command));
         findings.push(tierA({
             checkId: 'A1',
             name: 'install-lifecycle-script',
             subject: name,
-            severity: 'medium',
+            severity: signals.length === 0 ? 'medium' : 'high',
             title: `Declares a \`${name}\` script, which runs at install time once allowed`,
             detail: 'This command would run at the user\'s uid as part of `dsh plugin add`, before the user has read a '
                 + 'line of the package. Two things stand between it and execution, and neither is this package\'s doing: '
                 + '`dsh plugin add` forwards its arguments to pnpm verbatim and adds no --ignore-scripts, but pnpm ≥10 '
                 + 'blocks dependency lifecycle scripts by default until the exact package is listed under `allowBuilds` in '
                 + 'the profile\'s pnpm-workspace.yaml — and the harness prints that instruction itself when a build is '
-                + 'blocked (apps/cli/src/plugin.ts). Approving the prompt runs this command.',
-            evidence: { file: 'package.json', path: `scripts.${name}`, snippet: snippet(manifest.scripts[name] ?? '') },
+                + 'blocked (apps/cli/src/plugin.ts). Approving the prompt runs this command.'
+                + (signals.length === 0
+                    ? ''
+                    : ` The command ${signals.map(signal => signal.meaning).join(', and ')}. A build hook runs something `
+                        + 'this package shipped and this one does not, which is the shape 21.2 % of malicious npm packages '
+                        + 'take: the whole attack inside `package.json`, with no module to read.'),
+            evidence: { file: 'package.json', path: `scripts.${name}`, snippet: snippet(command) },
         }));
     }
     for (const command of manifest.binNames) {

package/lib/injection.js

@@ -62,6 +62,22 @@ export const INJECTION_RULES = [
         pattern: /[\u200b-\u200f\u202a-\u202e\u2060-\u2064\ufeff]|[\u{E0000}-\u{E007F}]/u,
         meaning: 'contains zero-width or bidirectional-control characters, which change what a human reader sees but not what the model reads',
     },
+    {
+        // Keyed on a run of four, not on a single selector. One selector is
+        // ordinary: U+FE0F and U+FE0E pick the emoji or text presentation of the
+        // character before them, and the U+E01xx plane carries the Ideographic
+        // Variation Sequences that CJK text uses, so firing on one would fire on
+        // every document with an emoji in it. Nothing standardised puts four in a
+        // row: a variation selector modifies the single character it follows, so a
+        // second one has nothing to modify. GlassWorm's five waves encoded
+        // executable JavaScript one byte per selector, which makes any real payload
+        // an unbroken run of tens to thousands. Four is far below that and above
+        // the doubled selectors that copy-paste through an editor produces.
+        id: 'variation-selector-payload',
+        pattern: /[\uFE00-\uFE0F\u{E0100}-\u{E01EF}]{4,}/u,
+        meaning: 'contains a run of variation selectors, which occupy no width in any editor, terminal or diff '
+            + 'view and can carry an arbitrary encoded payload one byte per selector',
+    },
     {
         id: 'hidden-html-instruction',
         pattern: /<!--[^]{0,400}?\b(?:you (?:must|should|are)|instruction|assistant|ignore)\b[^]{0,400}?-->/i,

package/lib/inspect.js

@@ -9,6 +9,7 @@
  * `cordis-yaml.ts`, and its result is discarded without being called.
  * @module dsh-plugin-inspector/inspect
  */
+import { readFileSync } from 'node:fs';
 import { EXPRESSION_CLASSES, PatchParseError, parsePatchDocument, } from "./cordis-yaml.js";
 import { isCordisConfigFile, isModelVisibleText, isSourceFile, normalizePackagePath } from "./files.js";
 import { HARNESS_REFERENCE } from "./knowledge.js";
@@ -18,8 +19,18 @@ import { loadSource } from "./source.js";
 import { runTierA } from "./checks/tier-a.js";
 import { runTierB } from "./checks/tier-b.js";
 import { NON_DEGRADING_CHECKS, runTierC } from "./checks/tier-c.js";
-/** This tool's own version, reported in the JSON document. */
-export const TOOL_VERSION = '0.1.0';
+/**
+ * This tool's own version, reported in the JSON document, by `--version`, and
+ * in the recorded ecosystem measurement.
+ *
+ * Read from this package's own `package.json` rather than written down a second
+ * time. A constant is a copy that only a release checklist keeps honest, and it
+ * stopped being honest for two releases: every report claimed `0.1.0` while the
+ * published package was `0.2.1`. The manifest sits one directory above this
+ * module in the source tree, in `lib/` after a build, and in the published
+ * tarball, so the same relative path resolves in all three.
+ */
+export const TOOL_VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 /** This tool's package name, reported in the JSON document. */
 export const TOOL_NAME = 'dsh-plugin-inspector';
 /**

package/lib/knowledge.js

@@ -291,6 +291,45 @@ export const SKILL_ROOT_CONFIG_KEYS = ['customSkillDirs', 'bundledSkillDir'];
 export const INSTALL_LIFECYCLE_SCRIPTS = [
     'preinstall', 'install', 'postinstall', 'prepare', 'prepublish', 'preprepare', 'postprepare',
 ];
+/**
+ * Command shapes that make an install lifecycle script the attack rather than
+ * the build.
+ *
+ * The head-to-head measurement on 6,420 malicious and 7,288 benign npm packages
+ * (ASE 2026) puts 72.21 % of malicious packages on a lifecycle hook and 21.2 %
+ * with the whole attack inside `package.json` scripts — no shipped module at
+ * all. That second number is what this table is for: it is the case where the
+ * command line itself fetches, decodes, or evaluates, and there is nothing else
+ * to read.
+ *
+ * Each pattern is chosen against the measured false-positive side rather than
+ * against the idea of a build script. The five packages in the pinned corpus
+ * that declare a hook run `tsdown`, `npm run build`, `husky`, and
+ * `node scripts/prepare.mjs`; running a shipped file is what a build hook is, so
+ * that shape is deliberately not a signal here.
+ */
+export const LIFECYCLE_SIGNALS = [
+    {
+        id: 'fetches-remote',
+        pattern: /\b(?:curl|wget|Invoke-WebRequest|iwr)\b/i,
+        meaning: 'fetches a remote resource at install time, so what runs is not what was published',
+    },
+    {
+        id: 'pipes-to-shell',
+        pattern: /\|\s*(?:sudo\s+)?(?:ba|z|k)?sh\b/,
+        meaning: 'pipes its input straight into a shell',
+    },
+    {
+        id: 'evaluates-inline-code',
+        pattern: /\b(?:node|deno|bun|ruby|perl)\s+(?:-\S+\s+)*--?e(?:val)?\b|\bpython3?\s+(?:-\S+\s+)*-c\b/,
+        meaning: 'evaluates code written on the command line, which no published file records',
+    },
+    {
+        id: 'decodes-payload',
+        pattern: /\bbase64\s+(?:-d|-D|--decode)\b|\batob\s*\(|\bBuffer\.from\([^)]*base64/,
+        meaning: 'decodes an encoded payload, which is how a command hides what it runs',
+    },
+];
 /** Entry fields the loader never interpolates: a `!!js` node here is inert data. */
 export const STATIC_ENTRY_FIELDS = [
     'id', 'name', 'group', 'inject', 'intercept', 'isolate',

package/lib/types/inspect.d.ts

@@ -11,8 +11,18 @@
  */
 import { type RegistryProvenance, type Report, type Severity } from './model.ts';
 import { type PluginSource } from './source.ts';
-/** This tool's own version, reported in the JSON document. */
-export declare const TOOL_VERSION = "0.1.0";
+/**
+ * This tool's own version, reported in the JSON document, by `--version`, and
+ * in the recorded ecosystem measurement.
+ *
+ * Read from this package's own `package.json` rather than written down a second
+ * time. A constant is a copy that only a release checklist keeps honest, and it
+ * stopped being honest for two releases: every report claimed `0.1.0` while the
+ * published package was `0.2.1`. The manifest sits one directory above this
+ * module in the source tree, in `lib/` after a build, and in the published
+ * tarball, so the same relative path resolves in all three.
+ */
+export declare const TOOL_VERSION: string;
 /** This tool's package name, reported in the JSON document. */
 export declare const TOOL_NAME = "dsh-plugin-inspector";
 /**

package/lib/types/knowledge.d.ts

@@ -110,6 +110,31 @@ export declare const SKILL_ROOT_CONFIG_KEYS: readonly string[];
  * only needs one of these to run code before the user has read a line of it.
  */
 export declare const INSTALL_LIFECYCLE_SCRIPTS: readonly string[];
+/** One thing a lifecycle command can do that a build never needs to. */
+export interface LifecycleSignal {
+    readonly id: string;
+    readonly pattern: RegExp;
+    /** What the match means, phrased for a report. */
+    readonly meaning: string;
+}
+/**
+ * Command shapes that make an install lifecycle script the attack rather than
+ * the build.
+ *
+ * The head-to-head measurement on 6,420 malicious and 7,288 benign npm packages
+ * (ASE 2026) puts 72.21 % of malicious packages on a lifecycle hook and 21.2 %
+ * with the whole attack inside `package.json` scripts — no shipped module at
+ * all. That second number is what this table is for: it is the case where the
+ * command line itself fetches, decodes, or evaluates, and there is nothing else
+ * to read.
+ *
+ * Each pattern is chosen against the measured false-positive side rather than
+ * against the idea of a build script. The five packages in the pinned corpus
+ * that declare a hook run `tsdown`, `npm run build`, `husky`, and
+ * `node scripts/prepare.mjs`; running a shipped file is what a build hook is, so
+ * that shape is deliberately not a signal here.
+ */
+export declare const LIFECYCLE_SIGNALS: readonly LifecycleSignal[];
 /** Entry fields the loader never interpolates: a `!!js` node here is inert data. */
 export declare const STATIC_ENTRY_FIELDS: readonly string[];
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-inspector",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Know what a DeepSeek Harness plugin does before you install it — static pre-install analysis of a plugin directory or tarball",
   "license": "MIT",
   "author": "Ivan Tyshchenko",