Verification
L1 · Found
Security
Critical
Health
Active
Trust
Unrated
What it doesAI
DSH runtime appearance/theming plugin: built-in palettes, light/dark/system modes, VS Code theme import and persistent theme library.
- Built-in color palettes and dual-seed theme generation
- Import themes from Open VSX and VS Code
- Persistent theme library with light/dark variants
AI-generated from the repo README — for reference only.
Installation
dsh plugin --profile web add github:MangMax/dsh-themesInstall method: GitHub · not yet tested in container (L3+)
Compatibility
| DSH Version | Status |
|---|---|
| not stated | Declared — not tested |
Requirements
- • Node.js: not stated
- • DSH: declared "not stated"
- • External credentials: none detected
Security Report
Automated static scan, not manual review.
DSH.SO VETCRITICAL85fe10
Security reviewAutomated review · daily
CRITICAL
Vet verdict is critical: blocking-level risk. Review before use.
2 critical·1 high·4 medium·0 score
plugin version
0.1.8dsh manifestscanned commit
85fe103cc2792026-08-21latest commit
85fe103cc279vet verdict
critical · npmscore 0Vet is an AST static scan (npm artifact or git source).
`[](https://www.dsh.so/artifact/dsh-themes-2/)`Disclaimer: automated static analysis, not a security guarantee. Always review what you install.
Risk details
| Risk | Rule | Location | Description |
|---|---|---|---|
| critical | R3 | index.cjs:3 | 直接访问 process.getBuiltinModule（Node 能力逃逸通道） |
| critical | R3 | index.cjs:3 | 直接访问 process.getBuiltinModule（Node 能力逃逸通道） |
| high | R2 | index.js:7 | new Function / new AsyncFunction 动态执行 |
| medium | R9 | client.js:8 | 递归无终止条件粗检：t 直接自调用且函数体内无条件分支 |
| medium | R2 | index.cjs:3 | require() 动态模块加载（npm 包内能力触达） |
Heuristic static scan — may produce false positives. Review the source yourself before trusting.
Activity
Last commit 2026-08-17 · activity: Active
• Repo created: 2026-08-21
• Stars: ★ 1 · Forks: 0
• Health: Active — committed within last 30 days
Source
GitHub: github.com/MangMax/dsh-themes