
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
dsh-pr-checks
Advanced tools
DSH plugin (host + web client): status and progress of GitHub Actions checks of the open PRs, grouped by workspace/project, in the sidebar footer.
DSH plugin (host + web client) that shows, in the sidebar footer, the status and progress of the checks (GitHub Actions) of the open PRs, grouped by Workspace → Project → PR.
done/total), colored dots per check (tooltip with the name) and a "PR checks" header.IN_PROGRESS/QUEUED/PENDING) are shown: when they finish, the PR drops out of the list — and with nothing running, the whole widget hides (it comes back when a check starts running again).The package is a DSH bundle (manifest dsh.bundle): it ships its own cordis.patch.yml layer, so installing it also registers the plugin row. Published on npm as dsh-pr-checks. To install it in a profile:
dsh plugin --profile <name> add dsh-pr-checks
# or directly from the git repository:
# dsh plugin --profile <name> add github:pauloapoloni/dsh-pr-checks
Alternatively, install the package directly (e.g. for an existing manual setup):
cd ~/.dsh/profiles/web
npm install github:pauloapoloni/dsh-pr-checks
and register the entry in the profile's cordis.patch.yml (only needed when not using the bundle layer):
- insert:
- id: dsh-pr-checks
name: dsh-pr-checks
config:
cacheMs: 10000 # response cache (ms)
includeAllAuthors: false # true = all open PRs, not only yours
If you previously added the entry manually and switch to the bundle install, remove the manual insert to avoid a duplicate row.
Restart dsh web and reload the GUI.
Prerequisite:
ghCLI authenticated withrepo/workflowscopes.
| Key | Default | Description |
|---|---|---|
cacheMs | 10000 | Endpoint response cache (ms) |
includeAllAuthors | false | true = all open PRs, not only yours |
authors | — | Logins to filter by (default: the authenticated gh user) |
repos | — | Extra repositories outside the workspaces (e.g. ["org/repo"]) |
lib/index.js): cordis plugin exposing GET /api/pr-checks. It discovers the git repositories in the DSH workspaces (~/.dsh/storages/workspace.json), queries the open PRs via gh pr list and returns { generatedAt, workspaces: [{ id, title, projects: [{ name, repo, prs: [{ number, title, url, draft, headRefName, checks: [{name,status,conclusion}], done, total }] }] }] }.lib/client.js): client bundle (in the window.__ModuleLoader__.load format) that registers the widget into the stock sidebar.footer.action slot — no patch to the sidebar bundle is required. It polls /api/pr-checks every 30s.Layout detail: the sidebar.footer.action slot is a flex row; the bundle injects a CSS rule that enables flex-wrap on the container's hashed class (.hHd-Xa_footerActions), so the widget takes the full row and the icons (e.g. the cordis panel) wrap to the next line. If a DSH update renames that class, the widget keeps rendering — just without the wrap.
cordis.patch.yml (config HMR). Changes to the code in lib/*.js require a dsh web restart (the loader does not reload already-imported modules; the client-modules registry caches resolution failures per process).MIT
FAQs
DSH plugin (host + web client): status and progress of GitHub Actions checks of the open PRs, grouped by workspace/project, in the sidebar footer.
We found that dsh-pr-checks demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.