dsh-provenance

Name: dsh-provenance
Author: Darren-Tang

PluginConfirmed pluginCommunity

Darren-Tang/dsh-provenance · updated 13 days ago

View source ↗

Installation

dsh plugin --profile web add dsh-provenance

dsh plugin --profile web add github:Darren-Tang/dsh-provenance

Plugins in this repository

dsh-provenancev0.1.0✓
Pre-install supply-chain provenance checks for DeepSeek Harness plugins: verify the tarball you're about to install matches the source you read, before any code runs. Never executes the audited package.
homepage
https://github.com/Darren-Tang/dsh-provenance#readme ↗
package.json
package.json
dsh.bundle.patch
cordis.patch.yml
Official core packages (2)
- @deepseek-ai/cordis^4.0.0-rc.7 || ^4shared
- @deepseek-ai/dsh-tools*shared

Paths are pinned to commit 0ccbbfb45b33

Overview

Pre-install supply-chain preflight for DeepSeek Harness plugins — verify what you install matches the source you read

Repository check result

Results are bound to the listed commit and cover only static checks run by this registry. The Evidence Score measures reviewable information; it is not a compatibility percentage or a security guarantee.

Static repository check

Sep 1, 2026, 5:46 AM

High risk

Checked commit: 0ccbbfb45b33
Evidence Score: 85/100
Static risk: High risk
Files scanned: 2
Findings: 2

Evidence breakdown

Source provenance25/25

Install documentation25/25

Maintenance12/20

Compatibility evidence20/20

Security signals3/10

Compatibility confidence: Medium

Install-time scripts (2)

prepacknpm run build
preparenpm run build

Findings (2)

Highinstall.script
package.jsoninstall-time
```
"prepack": "npm run build"
```
Highinstall.script
package.jsoninstall-time
```
"prepare": "npm run build"
```

Not run

Dependency advisory database scan
Installation execution test
Runtime behavior verification

Scanner 1.0.0 · Scorer 1.0.0