dsh.so
EN
English中文
@huihui4399/dsh-ssh-explorer avatar

@huihui4399/dsh-ssh-explorer

VSCode 式 SSH 远程资源管理器 · DSH 侧栏插件：双向拖拽传文件、就地编辑保存、右键新建/改名/删除、远端终端与 AI 对话

Ecosystem appDesktopTerminal / ShellFile
Verification
L5 · Ecosystem app
Risk
LowRisk
Health
Active
Trust
Silver

Install verification: Ecosystem app: not installed via dsh plugin add, so the L1-L5 plugin install-verification ladder does not apply; the security scan still runs.

L1–L5 verification rules

What it does

VSCode 式 SSH 远程资源管理器 · DSH 侧栏插件：双向拖拽传文件、就地编辑保存、右键新建/改名/删除、远端终端与 AI 对话

Installation

GitHub repository

Ecosystem apps are not installable via dsh plugin add: desktop / web shells install or deploy through their own release channel (GitHub Releases or the project site).

The level reads L5 · Ecosystem plugin / L5 · Ecosystem app per the three-way classification (the L1-L5 ladder does not rate them); the security scan still runs.

Verification & Compatibility

No verification record yet for this plugin.

  • • Node.js: not stated
  • • DSH: not stated
  • • External credentials: none detected

Author badges

Embed the official badges in your README to showcase security & install-test status:

dsh.so risk
`[![dsh.so risk](https://www.dsh.so/badge/dsh-ssh-explorer.svg)](https://www.dsh.so/artifact/dsh-ssh-explorer/)`

Security Report

Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.

dsh-ssh-explorerAutomated review · daily

Static low, dynamic no conclusion — stricter wins → overall low.

static low→dynamic no conclusion→overall low
0 critical·0 high
lowoverall · low
1static scan · vet primaryvet AST static analysis (npm artifact or git source)
Version binding
plugin version—
scanned version849189d141c6git2026-10-21
current version849189d141c6same version
vet verdictclean · git

Vet is an AST static scan (npm artifact or git source).

show static findings (10)
  • criticalsshWrite · destructiveplugin/lib/client.js:1579

    : "留空用 ~/.ssh/id_ed25519";

  • criticalshellExec · shellplugin/lib/index.js:1189

    const bootstrap = shq("import base64,sys;exec(base64.b64decode(sys.argv[1]))");

  • warningchildProcess · code-execplugin/lib/index.js:117

    const child = spawn(file, args, { ...options, stdio: ["pipe", "pipe", "pipe"] });

  • warningchildProcess · code-execplugin/lib/index.js:1214

    const child = spawn(context.binary, context.args, options);

  • warningchildProcess · code-execplugin/lib/index.js:3123

    const child = spawn("explorer.exe", [`/select,${target}`], { detached: true, stdio: "ignore" });

  • warningshellExec · shellplugin/lib/index.js:96

    execFile(file, args, options, (error, stdout, stderr) => {

  • warningnetIp · networkplugin/lib/index.js:2640

    const url = new URL(req.url ?? "/", "http://127.0.0.1");

  • warningbase64Decode · obfuscationplugin/lib/index.js:214

    $blob = [Convert]::FromBase64String($Payload)

  • warningbase64Decode · obfuscationplugin/lib/index.js:510

    const command = `echo ${shq(encoded)} | base64 -d | python3 - ${argText}`;

  • warningbase64Decode · obfuscationplugin/lib/index.js:576

    const command = `python3 -c "$(printf %s ${shq(encoded)} | base64 -d)" ${shq(target)}`;

2dynamic auditmodel reads redacted source context · never executes plugin code

no dynamic conclusion (source harvest or model call failed) — no conclusion is not a pass; the overall rating falls back to the static tier.

Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.

Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.

Activity

Last commit 2026-10-18 · activity: Active

• Repo created: 2026-10-18

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/huihui4399/dsh-ssh-explorer

Was this page helpful?