
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
dsh-bookmarks
Advanced tools
Bookmark assistant replies in DeepSeek Harness: per-message bookmarks with notes and tags, a cross-session bookmark center, and one-click Markdown export.
Bookmark assistant replies in DeepSeek Harness (DSH) Web UI: bookmark any finalized assistant reply with a note and tags, browse every bookmark from every session in one center panel, and export them to Markdown in one click.


dsh-bookmarks.md.Alt+B toggles the center from anywhere.dsh plugin --profile web add dsh-bookmarks
Then restart DSH (dsh web). The plugin appends itself to the profile bundle layer automatically; nothing else to configure.
For a local checkout:
# from the plugin repo
dsh plugin --profile web add file:./ # relative file spec, anchored to your cwd
The bundle row exposes three limits (all optional):
| Key | Default | Meaning |
|---|---|---|
maxNoteBytes | 4096 | Max UTF-8 bytes of one note ("" clears a note; omitting the field keeps it). |
maxSnippetChars | 300 | Max characters of the server-derived reply snippet. |
maxTags | 8 | Max tags per bookmark; each tag ≤ 32 chars, trimmed and deduplicated. |
Override them in the profile patch layer ($DSH_HOME/profiles/web/cordis.patch.yml):
- id: bookmarks
config:
maxNoteBytes: 2048
maxSnippetChars: 200
maxTags: 5
One npm package hosts both halves of the plugin:
lib/index.js) — the bookmarks Remote service (Typert), backed by a storage-domain table ($DSH_HOME/storages/bookmarks.json). put inspects the persisted session log to validate the target reply and derive its snippet, mirrors the official message-feedback durability barrier, and serializes mutations with per-item version tokens.src/client, bundled to lib/client.js) — mounts the Remote contribution through ctx.remote.$mount, then registers two UI slots: conversation.chat.assistant-actions (the per-message button) and sidebar.footer.action (the center toggle).npm install # zod + esbuild (dev only)
npm run build # bundles src/client into lib/client.js
lib/client.js is committed and shipped; no build step runs on install.
Alt+B when the sidebar is collapsed.This project is promoted on the LINUX DO community.
FAQs
Bookmark assistant replies in DeepSeek Harness: per-message bookmarks with notes and tags, a cross-session bookmark center, and one-click Markdown export.
We found that dsh-bookmarks demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.