rand0wn/dsh-malware-audit

README 摘要

dsh-malware-audit A DeepSeek Harness ( dsh ) plugin that scans installed plugins' real syntax trees for patterns shaped like malicious intent — the one thing every other dsh audit tool explicitly declines to do — with an optional periodic schedule and opt-in auto-quarantine on critical findings. Why dsh plugins run with real filesystem and process access, and installing one is a one-line command. Existing audit tools ( dsh-security-audit , dsh-plugin-audit ) do this well for capability — they report that a plugin can touch the filesystem, network, or credentials, then explicitly stop short of judging intent: "an audit aid, not an antivirus." dsh-malware-audit fills that specific gap: it looks for the handful of techniques that separate "this plugin can do a lot" from "this looks like it's hiding what it does" — dynamic code execution from strings, fetch-and-execute, cross-plugin file writes (the exact technique a real hot-reload plugin in the wild uses to inject code into other installed plugins), and exfiltration-shaped network calls. Still not an antivirus. There is no signature database of known-bad packages here — this can't tell you a specific npm package was reported compromi…

分类