{"_id":"@aaub-software/dsh-eslint-security-sast","_rev":"3-3c10978ec92f900fbeb1c60c4836de5f","name":"@aaub-software/dsh-eslint-security-sast","dist-tags":{"latest":"0.2.0"},"versions":{"0.1.0":{"name":"@aaub-software/dsh-eslint-security-sast","version":"0.1.0","keywords":["deepseek-harness","dsh-plugin","eslint","sast","security","typescript"],"license":"MIT","_id":"@aaub-software/dsh-eslint-security-sast@0.1.0","maintainers":[{"name":"xuzhongwang","email":"2698425919@qq.com"}],"homepage":"https://github.com/Baiiduu/dsh-eslint-security-sast#readme","bugs":{"url":"https://github.com/Baiiduu/dsh-eslint-security-sast/issues"},"dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"dist":{"shasum":"3f029bfef26679b1c106506880d8e3afa12bedf5","tarball":"https://registry.npmjs.org/@aaub-software/dsh-eslint-security-sast/-/dsh-eslint-security-sast-0.1.0.tgz","fileCount":28,"integrity":"sha512-5Jgtd5UOW2DB1ptZet5EgqmumGilxdFfKgFMlG6t7kVGIvsEYB36uNyEgQyezECPpCdLFYI47FUXFk4FlU34DQ==","signatures":[{"sig":"MEUCIF3NJb7n+NG/DHKX1lys5c/fJ04OMvGj4qz+nLgsueuKAiEAqoqhTjNC0pN+xwKzX/U241RBMY9y4snJD1NGLN/xNUg=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":60321},"main":"lib/index.js","type":"module","types":"lib/index.d.ts","engines":{"node":">=24.0.0"},"exports":{".":{"types":"./lib/index.d.ts","default":"./lib/index.js"},"./package.json":"./package.json","./cordis.patch.yml":"./cordis.patch.yml"},"scripts":{"build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"xuzhongwang","email":"2698425919@qq.com"},"repository":{"url":"git+https://github.com/Baiiduu/dsh-eslint-security-sast.git","type":"git","directory":"packages/bundle"},"description":"ESLint Security SAST bundle and model-facing scan tool for DeepSeek Harness.","directories":{},"_nodeVersion":"24.19.0","dependencies":{"eslint":"10.10.0","typescript":"6.0.3","eslint-plugin-security":"4.0.1","@deepseek-ai/schemastery":"^3.18.2","@typescript-eslint/parser":"8.69.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"@types/node":"^24.0.0","@deepseek-ai/cordis":"^4.0.2","@deepseek-ai/dsh-tools":"^0.1.2-rc.1","@deepseek-ai/dsh-sandbox":"^0.1.2-rc.1","@deepseek-ai/dsh-subprocess":"^0.1.2-rc.1","@types/eslint-plugin-security":"3.0.1","@deepseek-ai/dsh-user-approval":"^0.1.2-rc.1","@deepseek-ai/dsh-sandbox-policy":"^0.1.2-rc.1"},"peerDependencies":{"@deepseek-ai/cordis":"^4.0.2","@deepseek-ai/dsh-tools":"^0.1.2-rc.1","@deepseek-ai/dsh-sandbox":"^0.1.2-rc.1","@deepseek-ai/dsh-subprocess":"^0.1.2-rc.1","@deepseek-ai/dsh-user-approval":"^0.1.2-rc.1","@deepseek-ai/dsh-sandbox-policy":"^0.1.2-rc.1"},"_npmOperationalInternal":{"tmp":"tmp/dsh-eslint-security-sast_0.1.0_1788710560907_0.3807903440233589","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@aaub-software/dsh-eslint-security-sast","version":"0.1.1","keywords":["deepseek-harness","dsh-plugin","eslint","sast","security","typescript"],"license":"MIT","_id":"@aaub-software/dsh-eslint-security-sast@0.1.1","maintainers":[{"name":"xuzhongwang","email":"2698425919@qq.com"}],"homepage":"https://github.com/Baiiduu/dsh-eslint-security-sast#readme","bugs":{"url":"https://github.com/Baiiduu/dsh-eslint-security-sast/issues"},"dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"dist":{"shasum":"0e2c6ac7b6685f67d506b9c003928778c43ed967","tarball":"https://registry.npmjs.org/@aaub-software/dsh-eslint-security-sast/-/dsh-eslint-security-sast-0.1.1.tgz","fileCount":28,"integrity":"sha512-riJCBjZDVJw3Y4Fx1tnifCjkQ4ANDOqeU9rqnGQypesYgdsrDyZpRSrvCIhJlrHjkNhx4nARjKEEw/zP759e0w==","signatures":[{"sig":"MEUCICqe8FtXjd9tXoXEUK49xS+j5Ug9Ta+qz17vP+881SF1AiEAl9CC7pC/SCtrrpx3NdRVzueSaj2uKGtYbi+UjjWJ90A=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":60316},"main":"lib/index.js","type":"module","types":"lib/index.d.ts","engines":{"node":">=24.0.0"},"exports":{".":{"types":"./lib/index.d.ts","default":"./lib/index.js"},"./package.json":"./package.json","./cordis.patch.yml":"./cordis.patch.yml"},"scripts":{"build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"xuzhongwang","email":"2698425919@qq.com"},"repository":{"url":"git+https://github.com/Baiiduu/dsh-eslint-security-sast.git","type":"git","directory":"packages/bundle"},"description":"ESLint Security SAST bundle and model-facing scan tool for DeepSeek Harness.","directories":{},"_nodeVersion":"24.19.0","dependencies":{"eslint":"10.10.0","typescript":"6.0.3","eslint-plugin-security":"4.0.1","@deepseek-ai/schemastery":"^3.18.2","@typescript-eslint/parser":"8.69.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"@types/node":"^24.0.0","@deepseek-ai/cordis":"^4.0.2","@deepseek-ai/dsh-tools":"0.1.5-rc.2","@deepseek-ai/dsh-sandbox":"0.1.5-rc.2","@deepseek-ai/dsh-subprocess":"0.1.5-rc.2","@types/eslint-plugin-security":"3.0.1","@deepseek-ai/dsh-user-approval":"0.1.5-rc.2","@deepseek-ai/dsh-sandbox-policy":"0.1.5-rc.2"},"peerDependencies":{"@deepseek-ai/cordis":"^4.0.2","@deepseek-ai/dsh-tools":"^0.1.5-rc.2","@deepseek-ai/dsh-sandbox":"^0.1.5-rc.2","@deepseek-ai/dsh-subprocess":"^0.1.5-rc.2","@deepseek-ai/dsh-user-approval":"^0.1.5-rc.2","@deepseek-ai/dsh-sandbox-policy":"^0.1.5-rc.2"},"_npmOperationalInternal":{"tmp":"tmp/dsh-eslint-security-sast_0.1.1_1789098098679_0.5750255318542805","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"_id":"@aaub-software/dsh-eslint-security-sast@0.2.0","dsh":{"bundle":{"patch":"./cordis.patch.yml"}},"bugs":{"url":"https://github.com/Baiiduu/dsh-eslint-security-sast/issues"},"dist":{"shasum":"27701ccc317dac68faf709c9ab4a6949c7076fbe","tarball":"https://registry.npmjs.org/@aaub-software/dsh-eslint-security-sast/-/dsh-eslint-security-sast-0.2.0.tgz","fileCount":31,"integrity":"sha512-qSFsw4WJQ9HDk+vDzJSJLsXdeejBe8ufRD5R9J/28qrUy1TWUtREhAmmWDGCV7ShkBBnAaOy17GHhenwO1Dcwg==","signatures":[{"sig":"MEUCICgcaj1sq2+SPTye+vWILdmVHk5ZkL3X9RPLexq+zZy2AiEAxodjAf5ds7thjJ+mdoqs1+jHQGe44Zl5MkO+Nb9EIs4=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQCIQVDF+E4iwQ/IYBNAjwn78kZggSr32fBVuz8wjEEaSgIhAK38+CFR13n7pa14Glkvp/LlgYKAIvVQlUd3lEU2K6r4"}],"unpackedSize":72937},"main":"lib/index.js","name":"@aaub-software/dsh-eslint-security-sast","type":"module","types":"lib/index.d.ts","engines":{"node":">=24.0.0"},"exports":{".":{"types":"./lib/index.d.ts","default":"./lib/index.js"},"./package.json":"./package.json","./cordis.patch.yml":"./cordis.patch.yml"},"gitHead":"a11fcf99ddbffe8894a4dd644cbdf9b7f85d7323","license":"MIT","scripts":{"build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"version":"0.2.0","_npmUser":{"name":"xuzhongwang","email":"2698425919@qq.com"},"homepage":"https://github.com/Baiiduu/dsh-eslint-security-sast#readme","keywords":["deepseek-harness","dsh-plugin","eslint","sast","security","typescript"],"repository":{"url":"git+https://github.com/Baiiduu/dsh-eslint-security-sast.git","type":"git","directory":"packages/bundle"},"_npmVersion":"11.19.0","description":"ESLint Security SAST bundle and model-facing scan tool for DeepSeek Harness.","directories":{},"maintainers":[{"name":"xuzhongwang","email":"2698425919@qq.com"}],"_nodeVersion":"24.21.0","dependencies":{"eslint":"10.10.0","typescript":"6.0.3","eslint-plugin-security":"4.0.1","@deepseek-ai/schemastery":"^3.18.2","@typescript-eslint/parser":"8.69.0","@aaub-software/dsh-sast-contract":"0.1.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"@types/node":"^24.0.0","@deepseek-ai/cordis":"^4.0.2","@deepseek-ai/dsh-tools":"0.1.5-rc.2","@deepseek-ai/dsh-sandbox":"0.1.5-rc.2","@deepseek-ai/dsh-subprocess":"0.1.5-rc.2","@types/eslint-plugin-security":"3.0.1","@deepseek-ai/dsh-user-approval":"0.1.5-rc.2","@deepseek-ai/dsh-sandbox-policy":"0.1.5-rc.2"},"peerDependencies":{"@deepseek-ai/cordis":"^4.0.2","@deepseek-ai/dsh-tools":"^0.1.5-rc.2","@deepseek-ai/dsh-sandbox":"^0.1.5-rc.2","@deepseek-ai/dsh-subprocess":"^0.1.5-rc.2","@deepseek-ai/dsh-user-approval":"^0.1.5-rc.2","@deepseek-ai/dsh-sandbox-policy":"^0.1.5-rc.2"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/dsh-eslint-security-sast_0.2.0_1789696437859_0.8886916743416609"}}},"time":{"created":"2026-09-06T16:02:40.724Z","modified":"2026-09-18T01:53:58.091Z","0.1.0":"2026-09-06T16:02:41.043Z","0.1.1":"2026-09-11T03:41:38.830Z","0.2.0":"2026-09-18T01:53:57.942Z"},"bugs":{"url":"https://github.com/Baiiduu/dsh-eslint-security-sast/issues"},"license":"MIT","homepage":"https://github.com/Baiiduu/dsh-eslint-security-sast#readme","keywords":["deepseek-harness","dsh-plugin","eslint","sast","security","typescript"],"repository":{"url":"git+https://github.com/Baiiduu/dsh-eslint-security-sast.git","type":"git","directory":"packages/bundle"},"description":"ESLint Security SAST bundle and model-facing scan tool for DeepSeek Harness.","maintainers":[{"name":"xuzhongwang","email":"2698425919@qq.com"}],"readme":"# DeepSeek Harness ESLint Security SAST\n\n`@aaub-software/dsh-eslint-security-sast` is a Cordis bundle that registers the\nmodel-facing `eslint_security_scan` tool in\n[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness).\n\nIt scans JavaScript and TypeScript source with ESLint 10 and the recommended\nrules from `eslint-plugin-security`. Findings are security review candidates,\nnot automatically confirmed vulnerabilities.\n\n## Install\n\nDeepSeek Harness and Node.js 24 or newer are required. Install the prebuilt\nbundle into the profile you use, for example:\n\n```powershell\ndsh plugin --profile web add @aaub-software/dsh-eslint-security-sast\n```\n\nRestart the profile after installation. The agent will then see the\n`eslint_security_scan` tool.\n\n## Supported source\n\n- JavaScript: `.js`, `.mjs`, `.cjs`, `.jsx`\n- TypeScript: `.ts`, `.mts`, `.cts`, `.tsx`\n\nThe scanner uses ESLint 10.10.0, eslint-plugin-security 4.0.1, and\n@typescript-eslint/parser 8.69.0. All are installed as npm dependencies; no\nseparate scanner executable or Python runtime is required.\n\n## Behavior and safety\n\n- Accepts only workspace-relative files and directories.\n- Rejects paths and resolved symlinks that escape the active workspace.\n- Runs ESLint in a separate Node.js process controlled by Harness.\n- Supports cancellation, timeout, process-tree termination, and bounded output.\n- Does not load ESLint configuration or suppression files from the scanned\n  repository.\n- Ignores inline `eslint-disable` comments.\n- Does not enable cache files, autofix, TypeScript project services, or the\n  target repository's `tsconfig.json`.\n- Does not execute target source code, project plugins, or package scripts.\n- Requires no network access during normal scanning.\n\nThe tool reports parse diagnostics separately and marks incomplete coverage as\n`partial`. The agent should read surrounding source and trace relevant data flow\nbefore classifying a hotspot as a vulnerability or false positive.\n\n## Documentation and source\n\nSee the\n[repository documentation](https://github.com/Baiiduu/dsh-eslint-security-sast#readme)\nfor the complete English and Chinese guide, configuration details, security\nboundaries, and development instructions.\n\nSource:\n[Baiiduu/dsh-eslint-security-sast](https://github.com/Baiiduu/dsh-eslint-security-sast)\n\n","readmeFilename":"README.md"}