dsh-dep-audit: A Dependency Poisoning Risk Audit Plugin for DeepSeek Harness

What Does It Do?

Dependency audit is a DSH plugin for DeepSeek Harness that inspects your dependency tree for poisoning and risk exposure. It focuses on three things: scripts that run the moment a package is installed, overly loose version ranges, and dependencies pulled from outside the registry. Those are the exact paths behind large-scale npm poisoning incidents. Once enabled, you can run a dependency health check directly inside the harness and get a list of items that need human review. It is maintained by feely0208 under the MIT license, last updated on 2026-10-13.

Core Features

• High-risk script detection: flags dependencies carrying install or postinstall scripts, which execute at install time even if you never import the package in your code.
• Medium-risk source and version checks: identifies missing lockfiles, versions pinned to * or latest, and dependencies coming from git or http instead of the registry.
• Low-risk upper-bound warnings: surfaces version constraints like >=x.y.z that have no upper bound.
• Whitelist noise reduction: packages such as esbuild, sharp, and puppeteer that genuinely need install scripts are already whitelisted, cutting false positives.
• Report output: results can be read straight in the terminal or written to an HTML report for archiving and sharing.

How to Use This Plugin?

After enabling it in DSH, run the audit against your target project directory to scan the dependency tree of the current folder. A demo mode lets you preview what detections look like first, and you can emit the results as an HTML report when you need a record. The plugin only reports suspicious items: having an install script does not mean a package is malicious, so the final call is yours. It does not query CVE databases and does not perform package-name similarity checks, since typosquat detection produces too many false positives.