zoahdev/dsh-dep-audit

README 摘要

dsh-dep-audit Dependency supply-chain hygiene audit for DeepSeek Harness (dsh) projects and profiles. It answers: “can I trust the dependency graph of this dsh plugin / profile?” — peer ranges that resolve to nothing, dist-tags that contradict declared ranges, stale or unlicensed dependencies, non-registry sources, and installed versions that silently drifted from what package.json declares. Complements the rest of the zoahdev security suite: Tool Focus dsh-poison-guard malware / obfuscation scan of plugin code dsh-plugin-doctor publish readiness: manifest/patch/build/pack/install dsh-dep-audit dependency graph hygiene: resolvability, dist-tags, staleness, sources, licenses, drift Install Or run it standalone without installing into dsh: Checks Check What it verifies Status when triggered manifest package.json exists, parses, declares name / version fail peer-resolvable every peerDependencies range matches at least one published version on the registry fail dist-tag dist-tags.latest does not contradict a declared range (the broken- latest / ERESOLVE class, e.g. discussion 2763) warn source audited dependencies use registry specifiers, not git: / file: / link: / workspace: warn lice…

分类