
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
dsh-wsl-tray
Advanced tools
DSH plugin: Windows desktop shortcut and system-tray launcher for DSH running in WSL
中文 | English
A DeepSeek Harness plugin for WSL deployments: it puts a Windows desktop shortcut and a system-tray launcher in front of the DSH web server running inside WSL.
--no-open; only the tray opens it).watchdog.log (see Watchdog below).wscript.exe + VBS and
the entire chain is launched with window style 0.WSL_DISTRO_NAME set, /mnt/c
accessible).wscript.exe, powershell.exe, and wsl.exe.Once published to npm:
dsh plugin --profile web add dsh-wsl-tray
Or add it manually to a DSH web profile:
cd ~/.dsh/profiles/web
pnpm add dsh-wsl-tray
and add "dsh-wsl-tray" to package.json:
"dsh": {
"profile": {
"bundles": [
"@deepseek-ai/dsh-base",
"@deepseek-ai/dsh-web-app",
"dsh-wsl-tray"
]
}
}
Restart dsh web and open Settings → Plugins → Plugin configuration to see
the WSL 桌面与托盘 card.
The plugin writes four generated files:
| File | Location |
|---|---|
dsh.ico | %USERPROFILE%\.dsh\dsh-wsl-tray\dsh.ico |
dsh-tray.ps1 | %USERPROFILE%\.dsh\dsh-wsl-tray\dsh-tray.ps1 |
dsh-tray.vbs | %USERPROFILE%\.dsh\dsh-wsl-tray\dsh-tray.vbs |
start.sh | ~/.dsh/dsh-wsl-tray/start.sh |
and creates:
%USERPROFILE%\Desktop\DeepSeek Harness.lnk
While the tray runs, the watchdog maintains two runtime files (both are shown on the config card):
| File | Location |
|---|---|
watchdog.log | %USERPROFILE%\.dsh\dsh-wsl-tray\watchdog.log (rotated at 512 KB) |
watchdog-status.json | %USERPROFILE%\.dsh\dsh-wsl-tray\watchdog-status.json (latest tick) |
The shortcut points at wscript.exe, which runs dsh-tray.vbs; the VBS starts
the tray PowerShell hidden, and the tray starts start.sh inside WSL through
WScript.Shell.Run(..., 0, false).
The watchdog lives inside the tray helper (the one process that is deliberately independent of DSH), and answers the three questions a restart daemon has to:
Invoke-WebRequest probe of the DSH
web URL every probeIntervalSec (default 10 s, probe timeout 3 s). Each
probe records its status code or error text, so a refused connection
(nothing listening), a timeout (hung server) and a bad status stay
distinguishable in the log. DSH is only considered DOWN after
downThreshold (3) consecutive failed probes.wsl.exe) and the watchdog waits up to restartWaitSec (180 s) for the URL
to answer again: an answer = success, which resets the failure counter; an
unanswered window = one failed restart. After maxRestartFailures (3)
consecutive failures the watchdog pauses instead of looping forever. It
resumes from the tray menu (恢复守护进程), or automatically as soon as DSH
answers again.watchdog.log with a timestamp, level and the
probe detail; the current state machine snapshot goes to
watchdog-status.json every tick. The plugin card exposes both through
/dsh-wsl-tray/watchdog and /dsh-wsl-tray/watchdog-log.Phases: starting (initial boot grace) → probing (steady state) →
restarting (waiting after a restart) → backoff (cooldown) or paused
(give-up / manual pause). The tuning values above are baked into
dsh-tray.ps1; change them in src/artifacts.ts
(DEFAULT_WATCHDOG_CONFIG) and regenerate.
If npm publishing is not an option, install the prebuilt tarball that is included in this repository:
cd ~/.dsh/profiles/web
pnpm add /path/to/dsh-wsl-tray-github/dist/dsh-wsl-tray-0.1.4.tgz
Then add "dsh-wsl-tray" to the profile bundle list as above.
wscript.exe → VBS → hidden PowerShell tray.start.sh runs DSH in the foreground of the hidden
wsl.exe session, so WSL does not recycle the process after the one-shot
launcher exits.Start-Process $webUrl once DSH answers.dsh-tray.ps1 -Regenerate.npm install
npm run typecheck
npm test
npm run build
npm pack --dry-run
wsl --shutdown).FAQs
DSH plugin: Windows desktop shortcut and system-tray launcher for DSH running in WSL
We found that dsh-wsl-tray demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.