How to vet a dsh plugin before you install it
The dsh-plugin topic reached 1805 repositories within days of launch. Anyone can put a repo there — including people who would like their code to run on your machine with your permissions. This page is the checklist for deciding whether to trust one.
What a plugin can do
A dsh plugin is not a browser extension in a sandbox. It loads through cordis.yml into the same process as your agent, with the same reach: the files in your project, the shell your agent runs commands in, your network, and any API keys sitting in environment variables. A malicious plugin does not need to escalate anything — you already gave it everything when you added it to the loader.
DeepSeek's own safe-use guidance is blunt about this: only install plugins from sources you trust and have reviewed. There is no official review, signing, or malware scan behind the dsh-plugin topic.
This is not a hypothetical
Two weeks before this page was written, the Shai-Hulud worm compromised the keyv and cacheable npm packages and spread through 400+ packages with roughly two billion monthly downloads between them, per Wiz's analysis. Its latest wave hid payloads in AI agent config files — exactly the kind of file most scanners, and most humans, never read. We wrote up what that attack means for dsh users.
A dsh plugin is an npm package plus a loader entry. Every attack that works on npm works here, with one addition: the target is a process that holds your credentials and runs your shell.
The five-minute checklist
1. Confirm it is the repo you meant
Typosquatting is the cheapest attack there is: register a name one character away from a popular project and wait. Check the owner, the star count, and the creation date against the project you think you are installing. Our listings flag names that are one edit away from a more popular repo.
2. Read the install path
Open package.json and look at scripts — a postinstall script runs arbitrary code on your machine at install time, before the plugin ever loads. If a README tells you to pipe curl into a shell, download the script and read it instead.
3. Read the dependency list
The payload usually is not in the repo you are looking at; it is in something the repo depends on. Fewer dependencies means less to audit. Prefer projects with a committed lockfile and pinned versions over ones that float on latest.
4. Look for code that hides
Legitimate plugin source is small and boring. Long base64 or hex blobs, eval on constructed strings, a minified single-line file in a repo that claims to be source — each of these is a reason to close the tab.
5. Run it with the least privilege you can
Try a new plugin in a separate profile with the sandbox on and no production keys in the environment. Pin the version you reviewed (npm install pkg@1.2.3) so tomorrow's compromised release does not walk in through an unpinned range.
What our tiers mean — and what they don't
Verified on this site means we found the wiring of a real dsh plugin in the repo: a dependency on the Cordis runtime or a shipped cordis.yml. That is evidence it loads, not that it is safe. A perfectly wired plugin can still be malicious, so the checklist above applies to every tier equally. We do not label anything "safe" — a metadata crawl cannot establish that, no matter whose directory it is.
What we do flag are checkable facts: a name one edit away from a more popular repo, a homepage behind a link shortener, a description that asks you to pipe a download into a shell. These appear on a listing when they apply — the conclusion stays yours.
If you find something malicious
Report the repository to GitHub via Report abuse — takedown at the source protects everyone downstream. Then email us at contact@dsharness.org with the repo name and what you found: we review reports and delist repos that ship malicious code.
Frequently asked questions
- Are DeepSeek Harness plugins safe to install?
- They are community repositories with no official review behind them, so the honest answer is: as safe as the specific repo you picked. Treat a dsh plugin like any dependency you grant broad permissions to — review it, pin it, and run it with the least privilege you can.
- Does DeepSeek review or sign dsh plugins?
- No. The dsh-plugin topic is an open GitHub tag that anyone can apply. DeepSeek's guidance is to install only plugins you trust and have reviewed; there is no signing, no registry, and no official malware scanning as of August 2026.
- Can a dsh plugin steal my API keys?
- Technically yes. Plugins load into the agent process, which typically holds model API keys in environment variables and can run shell commands. That is why new plugins belong in a separate profile without production credentials.
- What does the Verified badge on this site mean?
- It means we found concrete evidence that the repo is wired as a real dsh plugin — a Cordis runtime dependency or a cordis.yml. It is a classification of what the repo is, not an audit of what its code does.
- What should I do if I installed a plugin that turned out to be malicious?
- Remove it from cordis.yml and uninstall the package, then rotate every credential that was reachable from that environment — model API keys first. Check shell profiles, cron jobs, and CI tokens for persistence, and report the repo to GitHub so it gets taken down.
Keep reading
New to the loader model? Start with how installation and cordis.yml work. For the supply-chain background, read what the Shai-Hulud npm worm means for dsh users.