← 返回扫描报告总表 · ← dshlib 图书馆

扫描报告 · dsh-better-sidebar

认证等级L1
DIDdid:cha2a:package:dsh-better-sidebar
身份锚点omdsh-dev/DSH-better-sidebar · npm 官方声明
来源npm
插件版本
安装dsh plugin add dsh-better-sidebar
扫描日期2026-08-18(2 天前)
扫描层级静态扫描(自研规则 + GuardDog 复核 + OSV 依赖)
扫描器版本dshlib-scan v0.1 · GuardDog 3.2.0 · OSV.dev

自研扫描:⚠️ 待审 · GuardDog 复核:⚠️ 待审 · OSV 依赖:未扫描

语义:扫描是提示信号,非安全审查。✅ 通过=无命中;⚠️ 待审=有命中需人工判断;❌ 失败=无法扫描。人工确认恶意→下架。本页全部内容由 dshlib 数据库派生(验证报告 可核对证据)。认证等级与依赖漏洞正交:L4 认证覆盖插件包内容/来源/生态,不覆盖依赖安全(见收录与验证标准)。结论有有效期:插件或运行时更新后,本页结论可能过期(>30 天将标注待复核)。本库能力与边界披露页

1. 自研扫描(dshlib-scan)

越权能力(233 处)

文件命中
package/lib/client-editor.js23715"read-write"
package/lib/client-editor.js23999"read-write"
package/lib/client-editor.js30577"sudo"
package/lib/client-editor.js3479exec(
package/lib/client-editor.js3640exec(
package/lib/client-editor.js3666exec(
package/lib/client-editor.js3668exec(
package/lib/client-editor.js3671exec(
package/lib/client-editor.js3682exec(
package/lib/client-editor.js3688exec(
package/lib/client-editor.js3690exec(
package/lib/client-editor.js6980exec(
package/lib/client-editor.js13769exec(
package/lib/client-editor.js15092exec(
package/lib/client-editor.js15394exec(
package/lib/client-editor.js15931exec(
package/lib/client-editor.js16239exec(
package/lib/client-editor.js16239exec(
package/lib/client-editor.js16257exec(
package/lib/client-editor.js16257exec(
package/lib/client-editor.js16280exec(
package/lib/client-editor.js16329exec(
package/lib/client-editor.js16816exec(
package/lib/client-editor.js17408exec(
package/lib/client-editor.js17465exec(
package/lib/client-editor.js17500exec(
package/lib/client-editor.js20274exec(
package/lib/client-editor.js20277exec(
package/lib/client-editor.js20294exec(
package/lib/client-editor.js22110exec(
package/lib/client-editor.js22127exec(
package/lib/client-editor.js22133exec(
package/lib/client-editor.js22135exec(
package/lib/client-editor.js22137exec(
package/lib/client-editor.js22786exec(
package/lib/client-editor.js22787exec(
package/lib/client-editor.js22792exec(
package/lib/client-editor.js22799exec(
package/lib/client-editor.js22819exec(
package/lib/client-editor.js22823exec(
package/lib/client-editor.js22829exec(
package/lib/client-editor.js22901exec(
package/lib/client-editor.js25425exec(
package/lib/client-editor.js25433exec(
package/lib/client-editor.js25564exec(
package/lib/client-editor.js25617exec(
package/lib/client-editor.js25660exec(
package/lib/client-editor.js25661exec(
package/lib/client-editor.js25668exec(
package/lib/client-editor.js25682exec(
package/lib/client-editor.js25705exec(
package/lib/client-editor.js25767exec(
package/lib/client-editor.js25786exec(
package/lib/client-editor.js25948exec(
package/lib/client-editor.js27422exec(
package/lib/client-editor.js28026exec(
package/lib/client-editor.js31006exec(
package/lib/client-editor.js31528exec(
package/lib/client-editor.js32296exec(
package/lib/client-editor.js33797exec(
package/lib/client-editor.js33817exec(
package/lib/client-mermaid.js3516exec(
package/lib/client-mermaid.js25941exec(
package/lib/client-mermaid.js27639exec(
package/lib/client-mermaid.js29603exec(
package/lib/client-mermaid.js29627exec(
package/lib/client-mermaid.js29787exec(
package/lib/client-mermaid.js37078exec(
package/lib/client-mermaid.js37078exec(
package/lib/client-mermaid.js37078exec(
package/lib/client-mermaid.js37078exec(
package/lib/client-mermaid.js37078exec(
package/lib/client-mermaid.js37078exec(
package/lib/client-mermaid.js37078exec(
package/lib/client-mermaid.js37637exec(
package/lib/client-mermaid.js37637exec(
package/lib/client-mermaid.js38921exec(
package/lib/client-mermaid.js40555exec(
package/lib/client-mermaid.js40559exec(
package/lib/client-mermaid.js40563exec(
package/lib/client-mermaid.js40567exec(
package/lib/client-mermaid.js40571exec(
package/lib/client-mermaid.js40664exec(
package/lib/client-mermaid.js40668exec(
package/lib/client-mermaid.js40672exec(
package/lib/client-mermaid.js40676exec(
package/lib/client-mermaid.js40680exec(
package/lib/client-mermaid.js40684exec(
package/lib/client-mermaid.js40688exec(
package/lib/client-mermaid.js40692exec(
package/lib/client-mermaid.js40696exec(
package/lib/client-mermaid.js40700exec(
package/lib/client-mermaid.js40704exec(
package/lib/client-mermaid.js40708exec(
package/lib/client-mermaid.js40712exec(
package/lib/client-mermaid.js40716exec(
package/lib/client-mermaid.js40720exec(
package/lib/client-mermaid.js40724exec(
package/lib/client-mermaid.js40728exec(
package/lib/client-mermaid.js40732exec(
package/lib/client-mermaid.js40736exec(
package/lib/client-mermaid.js40740exec(
package/lib/client-mermaid.js42473exec(
package/lib/client-mermaid.js42705exec(
package/lib/client-mermaid.js42706exec(
package/lib/client-mermaid.js42711exec(
package/lib/client-mermaid.js42712exec(
package/lib/client-mermaid.js43849exec(
package/lib/client-mermaid.js43863exec(
package/lib/client-mermaid.js44375exec(
package/lib/client-mermaid.js46004exec(
package/lib/client-mermaid.js46723exec(
package/lib/client-mermaid.js47152exec(
package/lib/client-mermaid.js47159exec(
package/lib/client-mermaid.js47172exec(
package/lib/client-mermaid.js47184exec(
package/lib/client-mermaid.js47201exec(
package/lib/client-mermaid.js47209exec(
package/lib/client-mermaid.js47254exec(
package/lib/client-mermaid.js47268exec(
package/lib/client-mermaid.js47293exec(
package/lib/client-mermaid.js47316exec(
package/lib/client-mermaid.js47326exec(
package/lib/client-mermaid.js47339exec(
package/lib/client-mermaid.js47367exec(
package/lib/client-mermaid.js47377exec(
package/lib/client-mermaid.js47390exec(
package/lib/client-mermaid.js47399exec(
package/lib/client-mermaid.js47407exec(
package/lib/client-mermaid.js47418exec(
package/lib/client-mermaid.js47435exec(
package/lib/client-mermaid.js47446exec(
package/lib/client-mermaid.js47446exec(
package/lib/client-mermaid.js47460exec(
package/lib/client-mermaid.js47462exec(
package/lib/client-mermaid.js47464exec(
package/lib/client-mermaid.js47496exec(
package/lib/client-mermaid.js47507exec(
package/lib/client-mermaid.js47514exec(
package/lib/client-mermaid.js47523exec(
package/lib/client-mermaid.js47541exec(
package/lib/client-mermaid.js47547exec(
package/lib/client-mermaid.js47565exec(
package/lib/client-mermaid.js47725exec(
package/lib/client-mermaid.js47727exec(
package/lib/client-mermaid.js47728exec(
package/lib/client-mermaid.js48685exec(
package/lib/client-mermaid.js53782exec(
package/lib/client-mermaid.js54076exec(
package/lib/client-mermaid.js54116exec(
package/lib/client-mermaid.js54121exec(
package/lib/client-mermaid.js54188exec(
package/lib/client-mermaid.js57319exec(
package/lib/client-mermaid.js59717exec(
package/lib/client-mermaid.js66957exec(
package/lib/client-mermaid.js74749exec(
package/lib/client-mermaid.js77852exec(
package/lib/client-mermaid.js77888exec(
package/lib/client-mermaid.js82959exec(
package/lib/client-mermaid.js89867exec(
package/lib/client-mermaid.js89878exec(
package/lib/client-mermaid.js90028exec(
package/lib/client-mermaid.js110542exec(
package/lib/client-mermaid.js110556exec(
package/lib/client-mermaid.js110557exec(
package/lib/client-mermaid.js110558exec(
package/lib/client-mermaid.js110559exec(
package/lib/client-mermaid.js110714exec(
package/lib/client-mermaid.js116867exec(
package/lib/client-mermaid.js117824exec(
package/lib/client-mermaid.js117838exec(
package/lib/client-mermaid.js118798exec(
package/lib/client-mermaid.js120164exec(
package/lib/client-mermaid.js120167exec(
package/lib/client-mermaid.js123172exec(
package/lib/client-mermaid.js123172exec(
package/lib/client-mermaid.js123190exec(
package/lib/client-mermaid.js123193exec(
package/lib/client-mermaid.js123197exec(
package/lib/client-mermaid.js123212exec(
package/lib/client-mermaid.js132468exec(
package/lib/client-mermaid.js133822exec(
package/lib/client-mermaid.js133842exec(
package/lib/client-mermaid.js133907exec(
package/lib/client-mermaid.js133910exec(
package/lib/client-mermaid.js136289exec(
package/lib/client-mermaid.js137750exec(
package/lib/client-mermaid.js138265exec(
package/lib/client-mermaid.js141601exec(
package/lib/client-mermaid.js144149exec(
package/lib/client-mermaid.js144522exec(
package/lib/client-mermaid.js146472exec(
package/lib/client-mermaid.js147935exec(
package/lib/client-mermaid.js147958exec(
package/lib/client-mermaid.js147964exec(
package/lib/client-mermaid.js148524exec(
package/lib/client-mermaid.js156199exec(
package/lib/client-mermaid.js159503exec(
package/lib/client-mermaid.js159503exec(
package/lib/client-mermaid.js159528exec(
package/lib/client-mermaid.js164719exec(
package/lib/client-mermaid.js164729exec(
package/lib/client-mermaid.js164740exec(
package/lib/client-mermaid.js165030exec(
package/lib/client-mermaid.js165048exec(
package/lib/client-mermaid.js165089exec(
package/lib/client-mermaid.js167975exec(
package/lib/client-mermaid.js180155exec(
package/lib/client-mermaid.js182214exec(
package/lib/client-mermaid.js182281exec(
package/lib/client-mermaid.js194641exec(
package/lib/client-mermaid.js195005exec(
package/lib/client-registry.js103exec(
package/lib/client-registry.js4187exec(
package/lib/client-registry.js6015exec(
package/lib/client-terminal.js3776exec(
package/lib/client-terminal.js3839exec(
package/lib/client-terminal.js5552exec(
package/lib/client-terminal.js5561exec(
package/lib/client-terminal.js8003exec(
package/lib/client-terminal.js8013exec(
package/lib/client.js103exec(
package/lib/client.js4187exec(
package/lib/client.js6015exec(
package/lib/index.js549exec(
package/src/client/browser.ts88exec(
package/src/bundle-route.ts85exec(
package/src/client/mermaid-blocks.ts77exec(
package/src/client/mermaid-blocks.ts99exec(
package/src/client/state.ts128exec(
package/src/client/theme.ts50exec(
package/src/client/theme.ts61exec(
package/src/client/DiffView.tsx57exec(

硬编码密钥(18 处)

文件命中
package/lib/client-mermaid.js108103token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js113686token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js116149token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js147250token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js150446token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js152330token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js155418token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js158563token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js163399token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js166565token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js169006token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js170226token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js171874token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js173182token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js176982token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js179220token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js190919token: " + symbol); switch (action[0]) { case 1: stack.push
package/lib/client-mermaid.js193798token: " + symbol); switch (action[0]) { case 1: stack.push

危险命令(1 处)

文件命中
package/lib/client-mermaid.js129457shutdown

数据外传(6 处)

文件命中
package/lib/client-mermaid.js22968token = parser.fetch
package/lib/client-mermaid.js29434token = this.fetch
package/lib/client-mermaid.js29466token = this.fetch
package/lib/client-mermaid.js29557tokens, fetch
package/lib/client-mermaid.js127086tokenKey = request
package/lib/client-mermaid.js127087tokenKey) : cancellationStrategy.receiver.createCancellationTokenSource(request

2. 第三方复核(GuardDog 3.2.0)

d === 'download') {
│                 downloadFile(target.path)
│                 return
│               }



────────────────────────────────────────
Assessment:  High risk  (8.2/10)
2 risks detected

3. 依赖漏洞(OSV.dev)

未查询。