DSH Plugin Security Scanner: 5 Red Flags Before You Install

--
title: "DSH Plugin Security Scanner: 5 Red Flags Before You Install"
description: "Learn how to spot risky DSH plugins before they compromise your workspace. A practical guide to using the DSH Quality Score system."
tags: ["security", "plugins", "dsh", "npm", "quality-check"]

canonical_url: https://dshquality.com/blog/dsh-plugin-security-scanner-guide

canonical_url: https://dshquality.com/blog/dsh-plugin-security-scanner-guide

When was the last time you actually read what a plugin does before installing it? Most developers click "install" without a second thought. But every plugin you add is third-party code running in your environment—and that's a security decision, not just a convenience.

This is where the DSH Quality Score comes in. It's an independent scoring system that evaluates plugins across maintenance health, documentation quality, npm ecosystem integration, and—most importantly—security posture.

The Problem: 35% of Plugins Are Risky

Looking at the current plugin rankings, here's what the distribution looks like:

• A-grade (excellent): 4 plugins
• B-grade (good): 4 plugins
• C-grade (acceptable with caveats): 6 plugins
• D-grade (high risk): 7 plugins

That's a 35% risk rate among evaluated plugins. Not something you want to ignore.

The Three Red Flags You Can't Skip

1. Missing dsh.bundle Declaration

This is the most common warning. Over half the D-grade plugins lack a proper bundle declaration, which means the plugin's package structure hasn't been audited. Without it, you have no guarantee the package is self-contained or that dependencies are properly scoped.

What to do: If a plugin says "missing dsh.bundle declaration," don't use it unless you've manually verified its source code.

2. Dangerous Install Scripts

This is the highest-risk warning. Some plugins include post-install scripts that execute arbitrary commands on your machine. These can range from harmless housekeeping to outright malicious code.

What to do: Any plugin flagged with "dangerous install script" should be treated as a hard no for production use. Period.

3. Stale Maintenance

A plugin that hasn't been pushed in 30+ days may have unpatched vulnerabilities. Security updates don't happen automatically—they require active maintenance.

What to do: Check the "last push" date. If a critical plugin is stale, find an actively maintained alternative.

How to Use the Scanner: A Practical Walkthrough

Let's look at the top-ranked plugins and what their scores tell us:

Rank #1: dsh-core (A, Score 92)

• Stars: 2.0k
• Last push: 1 day ago
• Security: None
• Verdict: Excellent. Actively maintained, no warnings.

Rank #4: dsh-memory-store (A, Score 84)

• Stars: 876
• Last push: 4 days ago
• Security: None
• Verdict: Strong. Good alternative for state management needs.

Rank #18: dsh-miner (D, Score 12)

• Stars: 12
• Last push: 1 month ago
• Security: Dangerous install script
• Verdict: Do not install. High risk, minimal adoption.

Rank #19: dsh-telemetry (D, Score 18)

• Stars: 8
• Last push: 1 month ago
• Security: Dangerous install script
• Verdict: Do not install. Telemetry plugins with dangerous scripts are especially risky.

The Bottom Line

Here's what I've learned from reviewing hundreds of plugin evaluations: the DSH Quality Score is the fastest way to separate safe tools from potential threats.

It takes about 30 seconds to check a plugin's grade and security warnings. That's 30 seconds you should invest before every installation.

If you're serious about workspace security, make the dsh plugin security scanner part of your routine. Your future self—and your production environment—will thank you.

Want to check a specific plugin? Visit dshquality.com and run the scan. Independent scoring, real-time security warnings, no gatekeeping.