
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
dsh-video-player
Advanced tools
Floating, draggable, resizable video scene player for DeepSeek Harness. Plays scene-per-MP4 clips from a Stash-style scene server, plus best-effort YouTube / Twitch / Jellyfin / custom links.


A floating, draggable, resizable video player for DeepSeek Harness (DSH). It mounts a small window over the web UI that plays scene-per-MP4 clips from a Stash-style scene server — propping a video feed beside your chat and paging through clips while you work. The window moves and resizes in real time, like a real PiP video. Stash is the star; other sources are best-effort.
npm install -g pnpm@11 # the container image ships no pnpm
dsh plugin --profile web add /path/to/dsh-video-player
# restart the web profile (bundle changes apply at boot only):
sh ~/.dsh/dsh-guard/restart-web.sh
Linked installs need an import bridge.
dsh plugin add <dir>installs the plugin as alink:symlink, and Node resolves the host module's imports from its realpath (/path/to/dsh-video-player), which sits outside the profile'snode_modules. Before installing from a local dir, give it a bridge:mkdir -p /path/to/dsh-video-player/node_modules/@deepseek-ai ln -s ~/.dsh/profiles/node_modules/@deepseek-ai/dsh-settings /path/to/dsh-video-player/node_modules/@deepseek-ai/dsh-settings ln -s ~/.dsh/profiles/web/node_modules/schemastery /path/to/dsh-video-player/node_modules/schemastery
<video> player with
controls (play/pause, scrub, fullscreen, volume). Inputs and buttons in the
title bar are excluded from the drag handler, so they stay clickable/typable.◀ / ▶ step scenes, a number
field + Go / Enter jumps anywhere, and a status line shows the exact stream
URL. The default server is http://host.docker.internal:9999 with
/scene/{no}/stream per clip; it supports Range requests (verified
206 Partial Content), so seeking works.<select> (which was unreliable in
DSH's dark UI). Picking a channel switches the source immediately./scene/N/stream suffix). Enter or the ▶ button plays; paste auto-plays.lib/index.js) — registers the dsh-video-player settings
namespace (schema: base, channel, url, scene) and serves
GET/POST /api/dsh-video-player/config. The POST handler writes through the
DSH settings service, so the source config persists in the real settings
store (not localStorage).lib/client.js) — self-contained (plain DOM, inject: [],
activates immediately). It polls GET /api/dsh-video-player/config (~2.5s)
and pushes title-bar changes back with POST, so the floating window and the
settings store stay in sync.export default drops inject. DSH's bundle loader unwraps a
module's default export to the bare function, silently discarding
inject/name — services then throw cannot get property "webServer" without inject at boot and take the whole app down. Fix: use named
exports only (export function apply, export const inject, export const name), exactly like the dsh-pet host bundle.inject: ["@deepseek-ai/dsh-client-runtime"] without requiring it,
and sat forever in pending (waiting for service: …). Fix: keep the client
self-contained with inject: [].link: installs. See the bridge note
above.dsh-video-player settings namespace is
registered; if the generic settings surface doesn't render it as its own
section, add a client settings card (like the pet's) so channel/link are
editable from Settings → dsh-video-player.FAQs
Floating, draggable, resizable video scene player for DeepSeek Harness. Plays scene-per-MP4 clips from a Stash-style scene server, plus best-effort YouTube / Twitch / Jellyfin / custom links.
We found that dsh-video-player demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.