
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
dsh-duizhang
Advanced tools
Reconciliation: statements, invoices and ledgers that have to balance. Bank/credit statement PDFs and invoice batches into ledger-ready tables, then reconciled — on a shared key in integer cents, or with no shared key at all by amount, date window, refere
Bank/credit statement PDFs and invoice batches into ledger-ready tables, then reconciled — on a shared key in integer cents, or with no shared key at all by amount, date window, reference numbers and fuzzy counterparty names.
The point is that it refuses to look right when it is wrong. reconcile_ledger compares in integer cents, so 0.1+0.2 never invents a phantom difference. extract_statement re-adds the running total independently (opening + credits − debits = closing) and, if it does not balance, names the row where it first breaks. match_transactions handles split (1:N) and combined (N:1) payments and declines to guess when the evidence is thin. dedupe_entities never merges anything — it shows the evidence, cross-checked against tax-ID checksums, and leaves the decision to a human.
Every set ships what_can_you_do — describe a task in any language, get the exact tool plus a ready-to-run call.
dsh plugin --profile <your-profile> add github:mario03690/dsh-duizhang
Thin config layer only (one @deepseek-ai/dsh-mcp-client row, shipped as cordis.patch.yml) — no tool code runs on your machine. Built against the MCP client config shape of the dsh v0.1 developer preview; verified against the live endpoint on 2026-08-22.
Mixed. The table operations are deterministic and cheap ($0.002–$0.008). The two extractors read documents with a model: extract_statement $0.03, extract_invoices $0.05. Every response reports its exact USD cost; failed calls are not charged.
No signup for the free anonymous quota. Documents are processed in memory and not retained. The config URL carries ?s=dsh-duizhang — a channel tag identifying the install path, not you.
Disclosure: built and run by the team behind ainetcafe.com — our own service, free tier plus paid usage. Full bundle (everything at once): dsh-netcafe. MIT.
| Signal | This plugin |
|---|---|
| Runtime | dsh v0.1 developer preview (Cordis v4). Touches only the MCP client config shape — the narrowest surface available. Verified against a live endpoint on 2026-08-22. |
| What runs locally | Nothing. Ships one cordis.patch.yml row; there is no tool code, no build step and no lifecycle script in this package. |
| Filesystem access | None. |
| Shell / process access | None. |
| Network access | Outbound HTTPS to ainetcafe.com only, from the MCP client that dsh already ships. |
| Credentials | None required for the free tier. An optional AllRouter key, if you supply one, is sent by dsh as a request header and is never stored by us. |
| Data retention | Documents and prompts are processed in memory and not retained. |
| Dependencies | One peer dependency: @deepseek-ai/dsh-mcp-client (ships with dsh). |
| License | MIT (see LICENSE). |
| Publisher | The team that runs ainetcafe.com. Issues get a same-day reply. |
A directory listing is not a security review. Read
cordis.patch.yml— it is short enough to read in full in under a minute.
FAQs
Reconciliation: statements, invoices and ledgers that have to balance. Bank/credit statement PDFs and invoice batches into ledger-ready tables, then reconciled — on a shared key in integer cents, or with no shared key at all by amount, date window, refere
We found that dsh-duizhang demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.