
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
dsh-usage is a DeepSeek Harness bundle that derives per-turn model usage and per-session estimated fees from the durable session log. It adds a modelCost session projection, an always-visible per-turn readout in the Web conversation footer, and a complete Usage section in Settings.
The plugin prices four disjoint Harness usage buckets: uncached input, cache read, cache write, and output. Reasoning tokens are already included in output and are never charged twice. Price schedules are effective-dated, so replay uses the rate active when each event was recorded instead of rewriting historical cost with today's price.
Build and install the bundle into a Harness profile:
pnpm install
pnpm run check
dsh plugin --profile web add E:\OtherSpace\dsh-plugins
dsh --profile web --dump-config
dsh --profile web
When running Harness from E:\OtherSpace\deepseek-harness, replace dsh with pnpm dsh and run the command from that checkout.
The first install (or adding the browser entry to an existing install) requires a Harness restart so the client plugin graph is discovered. During browser development, Harness's pnpm run dev:web flow can HMR later source changes.
The bundled cordis.patch.yml contains the USD prices published for deepseek-v4-flash and deepseek-v4-pro on 2026-04-24. DeepSeek can change prices; verify the official pricing page before relying on the estimate.
Every rate is one currency unit per million tokens. Matching is exact on both the Harness provider route and provider-owned model id. Add another row with a later effectiveFrom when a price changes; do not edit the old row if historical replay matters.
- id: usage
name: dsh-usage
config:
currency: CNY
rates:
- provider: deepseek-official
model: deepseek-v4-flash
effectiveFrom: '2026-04-24T00:00:00.000Z'
uncachedInput: 1
cacheRead: 0.02
cacheWrite: 1
output: 2
- provider: deepseek-official
model: deepseek-v4-pro
effectiveFrom: '2026-04-24T00:00:00.000Z'
uncachedInput: 3
cacheRead: 0.025
cacheWrite: 3
output: 6
Harness configuration layers replace a row's complete config value rather than deep-merging it, so a profile override must repeat both currency and the full rates list.
Every finalized turn displays one compact English-only line in the existing assistant action row:
Total 133K tokens · Input 1.1K · Cache 132K · Output 725 · Cost $0.0003276 USD
Total is Input + Cache + Output;Input is uncached input plus cache-write input;Cache is provider-reported cache-read input;Output is provider-reported output, including reasoning tokens.These values come from the durable whole-log modelCost.byTurn projection, not from the currently loaded page of messages, so history paging and compaction do not shrink an older turn's reading. If a provider reports no usage for a turn, the footer stays absent rather than presenting a misleading zero.
Cost appears only when every model call in that turn has provider usage and a matching configured rate. If either is missing, the token metrics remain visible and the cost segment is omitted; a partial amount is never presented as the turn total.
Open Settings → Usage to inspect replay-derived accounting. The independent page starts in All sessions scope and provides:
The page updates from Harness's global session projection feed. Its total cost displays -- whenever pricing or provider usage is incomplete, with an explanatory coverage note. This page is intentionally independent from Models: Models configures providers, while Usage observes calls across all configured providers.
The heatmap color encodes total token volume relative to the busiest visible day. Hover, focus, or click a day to inspect its exact Input, Cache, Output, and Cost. Daily buckets use UTC so replay remains stable across browsers and machines; future cells in the current week stay blank.
The former /cost command is intentionally not registered: the Web footer and Usage page cover its information without adding command rows to conversation history. Rows created by older local builds remain part of their durable session logs, but no new /cost execution is available.
The projection is replay-derived and adds no new session event. It currently covers:
assistant/chunk and assistant/message usage;compaction/summary usage;unpriced;without usage.Current Harness session-title LLM events record the request route but not provider usage, so title-generation fees cannot yet be reconstructed and are not included. Calls made by plugins that neither attach usage to an existing durable event nor use the agent loop are likewise outside the projection. A future Harness-wide usage event would remove this blind spot without changing the pricing model.
Noval's useful ideas are retained: provider-neutral usage, side-channel accounting, model/purpose summaries, and a compact 52-week activity view. Its JsonlUsageStore and metered client wrapper are not copied because Harness already owns a durable event log, replay projections, model routes, and Web extension slots. Reusing those seams avoids a second persistence format and keeps compaction, resume, and Web clients consistent.
FAQs
Token usage, estimated cost, and a 52-week activity dashboard for DeepSeek Harness Web
The npm package dsh-usage receives a total of 962 weekly downloads. As such, dsh-usage popularity was classified as not popular.
We found that dsh-usage demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.