dsh-agent-runtime

spawnWeb parses the child's stdout and persists the full authenticated URL (which carries the dsh web login token) to a predictable path. writeFileSync uses the default mode (0o666 masked by umask, typically 0644) and the directory is created with default permissions, so any other local user/process that can read DSH_HOME obtains a working session token and full web API access without any further authentication. The token is never expired or scrubbed by this plugin.

The command string is built by concatenation. Inside this file the only producer is Number(...) from netstat output, so it is not exploitable here; however isDshWebProcess is a public service method that sibling plugins call, and TypeScript types are erased at runtime. A caller passing a non-numeric value (e.g. from an external source) would inject into the PowerShell command line.

With shell:true, argv elements are joined into a shell command line without quoting, so shell metacharacters in any launchCmd element (or in ws, used as cwd) would be interpreted by the shell. The launch command comes from operator config (or the built-in argv array, which never starts with npx), so this is a hardening gap rather than a demonstrated attack path.

Leaks a developer-local absolute path/username into a published package, and on any machine where that path exists it becomes a trusted source for the executable that spawnWeb runs (process.execPath <that bin.js>), i.e. a stale/foreign checkout could be launched instead of the installed one. Impact is limited by the path being OS/volume specific and existence-checked.