dsh-dep-vuln-scan
Run the following command in DeepSeek Harness:
dsh plugin install 988hj7tczd-oss/dsh-dep-vuln-scan
Paste the following prompt into your AI chat to install this plugin:
Run dsh plugin install 988hj7tczd-oss/dsh-dep-vuln-scan in the DeepSeek Harness terminal; the source is available at https://github.com/988hj7tczd-oss/dsh-dep-vuln-scan , and the dependency vulnerability scan command becomes available immediately after installation.
About this plugin
Managing dependencies across multiple languages and ecosystems often turns vulnerability triage into one of the most time-consuming tasks in a project. Manually cross-referencing CVE databases against lock-file versions is slow and easily misses critical risks, especially in large monorepos.
dsh-dep-vuln-scan compresses that process into a single read-only scan: it auto-detects lock files for npm, PyPI, Go, crates.io, Maven, NuGet, and RubyGems within the workspace, batch-queries the free OSV API for confirmed vulnerabilities, and produces a structured table listing each package, its current version, CVE/GHSA ID, CVSS score, summary, and recommended fix version. The tool never writes, modifies, or installs any file, keeping remediation commands strictly advisory and leaving execution entirely to the user.
Well suited for developers maintaining polyglot projects or monorepos, CI/CD teams needing a quick dependency-security pre-check, and security engineers who want a clear supply-chain risk overview without extra API keys or heavyweight tooling.
Use Cases
- Run a pre-build dependency security gate in CI/CD to block packages with known CVEs from entering artifacts
- Sweep a large polyglot monorepo in batches to surface high-risk dependencies across npm, PyPI, and Go stacks
- Audit lock files zero-config before a release to get a CVSS-scored, fix-version-ready list before deciding on upgrades
Best For
- Developers or tech leads maintaining polyglot, multi-ecosystem codebases
- CI/CD and DevOps teams that need a dependency security gate inside their pipelines
- Security engineers who want a full supply-chain risk view with zero extra API keys or heavyweight tooling
Related Plugins
Free web search plugin for DeepSeek Harness with web search, X search, and page fetch; no signup or API key required, with automatic multi-engine failover.
AnySearch-powered web and vertical search plugin for DeepSeek Harness, offering real-time search, cleaned URL content, concurrent batch search via native web_search/web_fetch, no API key required.
Pixel-perfect webpage clone tool that uses an agent harness to turn any webpage into a scored, full-page React replica.
A bilingual cost-tracking plugin for DeepSeek Harness with session/daily cost, budget, official & custom provider balance, coding plan quotas, peak/off-peak pricing alerts, and history stats.