Darren-Tang/dsh-provenance

README 摘要

dsh-provenance English 中文 The source you read on GitHub is not necessarily the package you install. A supply-chain preflight for DeepSeek Harness plugins. It answers a question no other scanner in this ecosystem asks. Existing plugin scanners read the files already on your disk and ask "does this code do something bad?" . That is a useful question, but it comes second. The first question is: Is this code the code the author showed me? An npm tarball is whatever the publisher uploaded. The registry does not build it from the repository, and nothing forces the two to agree. A publisher can push clean source to GitHub, collect stars and reviews, then publish a tarball with one extra file in it. Every scanner that runs after dsh plugin add will happily scan the injected file as if it belonged there — and by then the package's install hooks have already executed. dsh-provenance runs before installation and compares three independent sources of truth: the npm registry, the upstream repository, and the bytes actually on the wire. What it checks Check Question answered Source pinning Does this specifier identify immutable content, or can it change under the same name? Registry integrity Do…

分类