What it does
Desktop shell for DeepSeek Harness (dsh) — Electron wrapper with tray, settings, dsh npm auto-update, and deb self-packaging (Linux)
Installation
dsh plugin --profile web add github:Quan-Robin/DSH-desktop-for-LinuxInstall method: GitHub · not yet tested in container (L3+)
Compatibility
| DSH Version | Status |
|---|---|
| not stated | Declared — not tested |
Requirements
- • Node.js: not stated
- • DSH: declared "not stated"
- • External credentials: none detected
Security Report
Automated static scan, not manual review.
Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.
code-exec ×10.1.37fd9c578484fb2026-08-17fd9c578484fbThe scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.
Disclaimer: automated static analysis, not a security guarantee. Always review what you install.
• Static heuristic scan: done (15 files)
• Dependency vulnerabilities: requires deep audit (L3+)
• Permission sandboxing: requires runtime testing (L4+)
Scan findings · 12
- warningHTTP request to a raw IP addresssrc/balance.js:118const res = await fetch(`http://127.0.0.1:${port}/api/session.list`, {
- warningHTTP request to a raw IP addresssrc/balance.js:153const res = await fetch(`http://127.0.0.1:${port}/api/state`, { signal: AbortSignal.timeout(1500) });
- warningHTTP request to a raw IP addresssrc/balance.js:170const res = await fetch(`http://127.0.0.1:${port}/api/usage`, { signal: AbortSignal.timeout(1500) });
- infoReads process.envsrc/balance.js:23let dshHome = process.env.DSH_HOME || path.join(os.homedir(), '.dsh');
- infoMakes network requests (fetch / axios)src/balance.js:82const res = await fetch('https://api.deepseek.com/user/balance', {
- infoMakes network requests (fetch / axios)src/balance.js:118const res = await fetch(`http://127.0.0.1:${port}/api/session.list`, {
- infoMakes network requests (fetch / axios)src/balance.js:153const res = await fetch(`http://127.0.0.1:${port}/api/state`, { signal: AbortSignal.timeout(1500) });
- infoHardcoded IP addresssrc/balance.js:118const res = await fetch(`http://127.0.0.1:${port}/api/session.list`, {
- infoHardcoded IP addresssrc/balance.js:153const res = await fetch(`http://127.0.0.1:${port}/api/state`, { signal: AbortSignal.timeout(1500) });
- infoHardcoded IP addresssrc/balance.js:170const res = await fetch(`http://127.0.0.1:${port}/api/usage`, { signal: AbortSignal.timeout(1500) });
- criticalChild process module usage (Node.js)src/usage-parse.js:7const { execFile } = require('node:child_process');
- warningShell command execution (exec / execSync)src/usage-parse.js:16execFile('zstd', ['-dc', '-q', file], { maxBuffer: 512 * 1024 * 1024, timeout: 30000 }, (err, stdout) => {
Heuristic static scan — may produce false positives. Review the source yourself before trusting.
Activity
Last commit 2026-08-17 · activity: Active
• Repo created: 2026-08-17
• Stars: ★ 7 · Forks: 1
• Health: Active — committed within last 30 days