dsh-malware-audit

Every dsh plugin runs with real filesystem and process access, and installing one is a single-line command. Existing audit tools report what a plugin can touch, then explicitly stop short of judging intent. dsh-malware-audit fills that narrow gap: it walks the real TypeScript-compiler AST of every installed plugin and looks for the handful of patterns that separate a legitimate multi-capability plugin from one that is concealing what it does, such as dynamic code execution from decoded strings, fetch-and-execute shell pipelines, cross-plugin file writes, and exfiltration-shaped network calls.

Beyond the manual scan command, it offers an optional periodic schedule and an opt-in auto-quarantine that kicks in on critical-severity findings. Quarantine safely moves the node_modules entry out of the profile and cleans the bundle list across every local profile, so no dangling reference can cause a hard boot failure on the next start.

This plugin is aimed at dsh users who install multiple third-party plugins and want a lightweight heuristic layer on top of the existing capability audits. It is not an antivirus and carries no signature database, but a small fixed set of AST-level rules catches the most common malicious techniques and gives a practical risk signal without the noise of a full sandbox.