
Security News
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
dsh-connector
Advanced tools
IM/聊天平台桥接 + 主流工具深度集成(dsh-plugin-hub 官方可扩展类插件):把微信(企微)/飞书/钉钉/QQ 等 IM 的消息接入 dsh 会话,对话中直接收发 IM 消息、深度调用 dsh 工具链。
把 IM/聊天平台的消息接入 dsh 会话:微信(企业微信)、飞书、钉钉、QQ 等平台的消息 桥进 dsh,对话中直接收发 IM 消息、深度调用 dsh 工具链。
归属:本包是 dsh-plugin-hub 官方可扩展类插件(hub 内标记「可扩展类 / Hub Extensions」= 官方自研)。
IM 平台(飞书/企微/钉钉/QQ) dsh
┌───────────────────┐ webhook ┌────────────────────────────┐
│ 事件订阅 / 长连接 │ ──────────► │ ConnectorHub (注册表) │
│ 消息 → ImMessage │ │ ├ feishu / wecom / ding… │
└───────────────────┘ │ ├ 统一事件模型 │
▲ │ └ subscribe(platform, fn) │
│ send(chatId, text) │ │ │
└─────────────────────────│ 工具桥接:对话中调用 send() │
└────────────────────────────┘
src/connector.js:IMAdapter(start/stop/send/onMessage)+ ConnectorHub(多平台注册表、消息分发)IMAdapter 即可接入| 平台 | 状态 | 通道 | 说明 |
|---|---|---|---|
| 飞书 | ✅ 已实现 | 开放平台事件订阅 + 发消息 API | 官方正规,src/adapters/feishu.js |
| 企业微信 | ⏳ 规划 | 企业微信开放 API | 微信官方通道;个人微信无官方 API,不做 |
| 钉钉 | ⏳ 规划 | 钉钉开放平台 | 官方 API |
| ⏳ 规划 | QQ 开放平台机器人 | 官方 API | |
| Slack | ⏳ 规划 | Web API | 海外通用 |
dsh plugin --profile web add E:/DeepSeek Harness/work/dsh-connector
export DSH_CONNECTOR_CONFIG='{"feishu":{"enabled":true,"appId":"cli_xxx","appSecret":"xxx","verifyToken":"xxx","port":8787}}'
飞书适配器已启动;http://<本机>:8787/feishu/event,给应用发消息即可桥接;ctx.imConnector.send(platform, chatId, text) 发消息回 IM。FAQs
IM/聊天平台桥接 + 主流工具深度集成(dsh-plugin-hub 官方可扩展类插件):把微信(企微)/飞书/钉钉/QQ 等 IM 的消息接入 dsh 会话,对话中直接收发 IM 消息、深度调用 dsh 工具链。
The npm package dsh-connector receives a total of 0 weekly downloads. As such, dsh-connector popularity was classified as not popular.
We found that dsh-connector demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.