DSH Plugin Sentinel

dsh-plugin-sentinel · candidate · verdict review

This page is automated evidence, not an endorsement. It does not guarantee that this plugin is safe.

Evidence

Digest: sha256:c1c4b47540d547fc15b16c2b05d3889d99522f8bbdadd9b8ea1a12d2f4272be5
Source: https://github.com/BotonJ/dsh-plugin-sentinel
Maintenance coordinates: github:BotonJ/dsh-plugin-sentinel@3dcff7a125d7151f2b75a8962c65425d0d9aa0b8
Immutable revision: https://github.com/BotonJ/dsh-plugin-sentinel/tree/3dcff7a125d7151f2b75a8962c65425d0d9aa0b8
Tested DSH versions: None declared
Canonical report: reports/dsh-plugin-sentinel.json (JSON)

Findings

high DSH-CODE-001 Dynamic code execution — Source contains dynamic code execution (eval, new Function, or node:vm). at src/rules.js:48
high DSH-CODE-001 Dynamic code execution — Source contains dynamic code execution (eval, new Function, or node:vm). at test/fixtures/comment-fp/index.js:6
high DSH-CODE-001 Dynamic code execution — Source contains dynamic code execution (eval, new Function, or node:vm). at test/fixtures/obfuscated/index.js:5
high DSH-CODE-001 Dynamic code execution — Source contains dynamic code execution (eval, new Function, or node:vm). at test/scanner.test.js:21
high DSH-CODE-002 Process execution — Source invokes child processes or a shell. at src/rules.js:40
high DSH-CODE-002 Process execution — Source invokes child processes or a shell. at test/audit.test.js:69
high DSH-CODE-002 Process execution — Source invokes child processes or a shell. at test/fixtures/comment-fp/index.js:7
high DSH-CODE-002 Process execution — Source invokes child processes or a shell. at test/fixtures/shell-rm/index.js:1
high DSH-CODE-002 Process execution — Source invokes child processes or a shell. at test/scanner.test.js:87
high DSH-CODE-003 Environment or credential access — Source reads environment variables or references credential material. at src/audit.js:333
high DSH-CODE-003 Environment or credential access — Source reads environment variables or references credential material. at src/rules.js:79
high DSH-CODE-003 Environment or credential access — Source reads environment variables or references credential material. at test/audit.test.js:35
high DSH-CODE-003 Environment or credential access — Source reads environment variables or references credential material. at test/fixtures/comment-fp/index.js:18
high DSH-CODE-003 Environment or credential access — Source reads environment variables or references credential material. at test/fixtures/exfil-skin/scripts/telemetry.js:8
high DSH-CODE-003 Environment or credential access — Source reads environment variables or references credential material. at test/index.test.js:18
high DSH-CODE-003 Environment or credential access — Source reads environment variables or references credential material. at test/scanner.test.js:35
high DSH-CODE-004 Network access — Source performs network I/O. at src/rules.js:86
high DSH-CODE-004 Network access — Source performs network I/O. at test/audit.test.js:158
high DSH-CODE-004 Network access — Source performs network I/O. at test/fixtures/comment-fp/index.js:8
high DSH-CODE-004 Network access — Source performs network I/O. at test/fixtures/exfil-skin/scripts/telemetry.js:12
high DSH-CODE-004 Network access — Source performs network I/O. at test/scanner.test.js:22