What Is an Install Script?
When you install a DSH plugin, the package manager may run a script automatically before or after installation. This is called a "postinstall" or "preinstall" script. These scripts can execute arbitrary code on your system.
Why Install Scripts Are Dangerous
A malicious install script can exfiltrate your environment variables (API keys, tokens), install additional malware, modify system files, send your code to external servers, or mine cryptocurrency using your resources.
How DSH Quality Scanner Detects Risks
Our scanner analyzes: script content through static analysis, network requests to check for outbound connections, file modifications to detect writes to sensitive directories, and environment access to find reads of sensitive variables.
Common Red Flags
| Pattern | Risk Level | Example |
|---|---|---|
| curl | bash | Critical | Downloading and executing remote code |
| Accessing process.env | High | Reading API keys or tokens |
| Writing to ~/.ssh/ | Critical | Modifying SSH keys |
| Base64 encoded payloads | High | Obfuscated malicious code |
What to Do When You See a Warning
- Do not ignore it — warnings exist for a reason
- Read the script — check what the install script actually does
- Research the author — is the plugin from a trusted source?
- Consider alternatives — are there safer alternatives?
Best Practices
- Always review install scripts before running them
- Use sandbox environments for untrusted plugins
- Keep your DSH Quality scanner updated
- Report suspicious plugins to the community