
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
dsh-remote-access
Advanced tools
dsh Web GUI remote access: bind the webserver to 0.0.0.0 for LAN/remote access and inject the crypto.randomUUID polyfill for non-secure HTTP origins.
让 dsh Web GUI 支持远程访问:将 webserver 绑定到 0.0.0.0,让同一网络内(或 VPN 内)的其他设备也能通过浏览器访问;同时注入 crypto.randomUUID polyfill,修复浏览器在非安全上下文(普通 HTTP 的局域网/IP 来源)下无法运行客户端 bundle 的问题。
安全性说明:本插件面向可信网络(局域网 / 私有 VPN)。开启后 Web GUI 不再只绑定 loopback,切勿直接暴露到公网。公网安全访问请配合 Tailscale / Cloudflare Tunnel / WireGuard 等网络层隔离方案。
两种方式任选其一:
# 从 GitHub
dsh plugin --profile web add github:KongXiangning/dsh-remote-access
# 从 npm
dsh plugin --profile web add dsh-remote-access
重启后,其他设备通过 http://<本机局域网IP>:<端口> 访问;关闭开关并重启后恢复仅本机可访问。
cordis.patch.yml 改写为:webserver 行绑定 0.0.0.0,connection 行把 /api 浏览器信任围栏指向本机局域网 IPv4 地址crypto.randomUUID polyfill 始终注入(安全来源下无副作用,LAN HTTP 下必需),无需单独配置dsh web --port <N>,插件不改变端口dsh-remote-access/
├── package.json # dsh.bundle + dsh.client 声明
├── cordis.patch.yml # 插入 remote-access 插件行
├── index.js # host 半:settings 命名空间 + patch 改写 + polyfill
└── lib/client.js # browser 半:设置卡片(手写 bundle,无构建步骤)
MIT
FAQs
dsh Web GUI remote access: bind the webserver to 0.0.0.0 for LAN/remote access and inject the crypto.randomUUID polyfill for non-secure HTTP origins.
We found that dsh-remote-access demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.