@shaoshi/dshscan: DSH Plugin Security Scanner

@shaoshi/dshscan is a security scanner designed for DSH plugins, addressing the security risks arising from plugins running with the current process privileges. This tool is open-sourced under the MIT license. Its core functionalities include dual-channel scanning (static and semantic), built-in DSH-specific attack surface rules (such as plugin tree injection, malicious browser-side code, etc.), and integration with npm dependency auditing. It supports various input forms, including plugin names, GitHub repositories, local directories, or ZIP packages. The output comprises JSON or HTML reports that include risk scores, severity levels, and security recommendations. The tool features offline static scanning capabilities, offers optional LLM-based semantic analysis, and supports batch scanning, custom rules, policy file configuration, and web dashboard visualization. Additionally, it provides a built-in Benchmark evaluation set to test recall rates and...