
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
dsh-pdf-reader
Advanced tools
DeepSeek Harness plugin: content-aware PDF reading tools for vision models (pdf_scan / pdf_read_page / pdf_render_region). Detects figures (vector+raster), tables, math, and two-column layout per page, then routes text pages to extraction and figure/table
DeepSeek Harness plugin for content-aware PDF reading by vision models.
The plugin reads a PDF the way its content demands: text-heavy pages are extracted as text, while figures, tables, formula-heavy or two-column pages are rendered as high-DPI region crops fed to the vision model — so a paper's vector figures and structured tables are never lost to the per-image token ceiling.
Backed by PyMuPDF. When Python or a dependency is missing, the tools return a clear, actionable warning (with the exact install command) for the agent to resolve, instead of failing hard.
dsh plugin --profile web add dsh-pdf-reader
Requires a Python interpreter with pymupdf.
After installing Python, you can install the
dsh-python-env plugin in DeepSeek
Harness so the agent handles the dependency automatically — it will create a
project venv and install pymupdf itself, with no manual steps:
dsh plugin --profile web add dsh-python-env
To set it up by hand instead:
python -m venv .venv
.venv\Scripts\python.exe -m pip install pymupdf
| Tool | What it does |
|---|---|
pdf_scan | Per-page content profile — columns, figures (vector regions), raster images, tables, text characters, hasGraphics, formulaRisk, hasTextLayer. Use first to decide how each page should be read. |
pdf_read_page | Read one page the right way: pdf_scan's profile routes text pages to extraction and figure/table/math pages to a high-DPI region crop (path for read_image). mode=text / mode=render force a path. |
pdf_render_region | Render a specific [x0,y0,x1,y1] region of a page to a PNG at budget-filling DPI (or an explicit dpi), returning its path for read_image. |
A two-column paper's figures are usually vector (only page rasterization can see them), tables lose structure under text extraction, and formulas garble in some text layers. Meanwhile DeepSeek caps each image at ~800×800-equivalent / 384 tokens — so reading a whole two-column page at that budget makes each column ~350px and loses small text, sub/superscripts and figure detail. The fix:
dpi = 72 × sqrt(640000 / region_pt_area). Content is
complete (nothing legible is lost inside the budget) and token-optimal
(rendered AT the budget, not beyond it).Region detection is heuristic (not a perfect classifier) and deliberately biased
toward rendering — vector clusters from get_drawings(), raster rects from
get_image_rects(), the same clustering for tables, and math from fonts + a LaTeX
producer. It over-flags (a ruled table or a logo may be treated as a figure) rather
than under-flagging, because rendering is cheap and safe.
Each tool resolves a Python interpreter in priority order — the activated venv
($VIRTUAL_ENV) first, then PATH python/python3/py, then the project
.venv/venv/env — probes it for pymupdf (and optionally pymupdf4llm), and
picks the first one that can import it. If none can, it returns a warning naming
what is missing and how to fix it, so the agent can install the dependency,
switch interpreters, or fall back.
page.find_tables() false-positives on plot grids and diagrams, so tables
are primarily read by rendering (the reliable path); Markdown tables from
pymupdf4llm are a best-effort extra.pdf_render_region on an equation when exact structure is needed.@deepseek-ai/cordis ^4, @deepseek-ai/dsh-tools (peer deps,
provided by the harness).pymupdf (optional pymupdf4llm).MIT
FAQs
DeepSeek Harness plugin: content-aware PDF reading tools for vision models (pdf_scan / pdf_read_page / pdf_render_region). Detects figures (vector+raster), tables, math, and two-column layout per page, then routes text pages to extraction and figure/table
The npm package dsh-pdf-reader receives a total of 122 weekly downloads. As such, dsh-pdf-reader popularity was classified as not popular.
We found that dsh-pdf-reader demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.