dsh-poison-guard

When using DeepSeek Harness, installing third-party plugins directly poses a risk of supply chain poisoning, where malicious code may be hidden within obfuscated logic or complex structures that simple regex scans often fail to detect. dsh-poison-guard provides a three-layer deep detection mechanism. It uses NodeSecure JS-X-Ray for AST static analysis to track variables and dynamic imports, a deobfuscation decoder to handle common encoding bypasses, and regex heuristics to scan installation scripts, offering comprehensive threat visibility. Designed to serve as part of a defense-in-depth strategy, it helps developers and operators identify hidden data exfiltration, dangerous system commands, and forged credentials, making it ideal for environments that manage a large volume of plugins while prioritizing security.