zoahdev/dsh-poison-guard-action

README excerpt

dsh-poison-guard-action A GitHub Action that scans a DeepSeek Harness plugin for supply-chain poisoning before you publish or merge — powered by dsh-poison-guard (AST analysis via NodeSecure JS-X-Ray + deobfuscation decoder + regex heuristics). One line in your workflow turns "it loads" into "it was scanned for obfuscated exfiltration, dynamic eval, hidden shell commands, and install-time scripts". Usage Inputs Input Default Meaning path . Plugin directory to scan version v0.2.0 dsh-poison-guard release tag to install fail on MALICIOUS Verdict that fails the job ( MALICIOUS or SUSPICIOUS ) Outputs Output Meaning verdict CLEAN , SUSPICIOUS , or MALICIOUS Findings are surfaced as GitHub annotations ( ::error for HIGH, ::warning for MEDIUM) and written to the run summary. Why DeepSeek Harness plugins are distributed as source checkouts, npm packages, and git tarballs — any of which can carry an obfuscated require , a base64-hidden exfiltration URL, or a postinstall shell command. This action runs the same AST + deobfuscation scan a maintainer would run before any user installs the plugin. License MIT 中文说明 一个 GitHub Action，在你的 DeepSeek Harness 插件 发布或合并之前 做供应链投毒扫描，底层是 dsh-poison-guard（A…

Category