dsh-dep-audit：依赖树投毒与供应链风险检查
dsh-dep-audit（@deepwhale-cn/dsh-dep-audit）是 feely0208 维护的 DSH admin-security 插件，扫描当前目录依赖 manifest 与 lock，标出 install/postinstall 脚本、无 lockfile、* / latest、git/http 来源及无上界的 >= 约束等供应链风险面。支持 dsh plugin 安装与 npx 纯 CLI，可 --demo 与 --html 出报告。不查 CVE、不做 typosquat；带 install 脚本的常见包有白名单，命中项需人工确认。
Read Moredsh-dep-audit: DeepSeek Harness Dependency Supply Chain Hygiene Audit
`dsh-dep-audit` is a dependency supply-chain hygiene audit plugin for DeepSeek Harness, designed to validate the reliability and security of plugin/Profile dependency graphs through checklist inspection. Its core capabilities include manifest validation, peer dependency resolvability detection, invalid dist-tag detection, dependency source registry validation, license and freshness checks, version drift detection, and outdated version checks. Users can run it directly via the command line or through Agent interaction to generate a JSON-formatted report for identifying potential security risks and runtime anomalies.
Read More