A dsh security advisory is the notice we publish when a plugin in the index crosses from worth watching to do something now. This weekly advisory roundup collects every plugin security advisory raised in the past seven days, explains what each severity band means, and shows how to wire an advisory feed into the tools your team already reads. If you check one thing this week, check whether any plugin you have installed appears in the list below.
What counts as an advisory
An advisory is a specific finding tied to a specific version, not a general impression of quality. A plugin can carry a mediocre score for months without generating one. Four situations produce an advisory:
- A dangerous install script, which means the install step does something a normal plugin has no reason to do: reach the network, write outside its own directory, or read credential files.
- A missing or contradictory dsh.bundle declaration, where the plugin claims capabilities the packaged files do not match.
- A maintainer or repository change that breaks the chain of trust, such as a transfer to an account created the same week.
- A dependency that has itself been flagged, because risk arrives through the tree and not only through the top-level package.
How severities are graded
| Severity | What triggers it | What to do |
|---|---|---|
| Critical | A dangerous install script or a confirmed malicious payload in a published version | Remove the plugin, rotate any credential it could reach, then audit the machines that installed it |
| High | Missing bundle declaration combined with an obfuscated or network-calling install step | Disable the plugin, keep a copy of the logs, and wait for an upstream fix before re-enabling |
| Medium | Maintainer account change, repository transfer, or a dependency unmaintained for over a year | Pin the version and add the plugin to a watchlist |
| Low | Documentation drift, stale metadata, or a score drop with no security signal attached | Note it and handle it in the next review cycle |
The band describes urgency, not evil intent. A Low advisory on a plugin you do not depend on is noise; the same band on a plugin that touches your CI credentials is worth an hour of your time.
Reading an advisory without overreacting
- Check the version first. An advisory against 2.1.0 does not apply if you pinned 1.8.4, and the plugin page shows which versions are affected.
- Separate install-time risk from runtime risk. Most findings sit in the install step, which means a plugin already installed last year may never have executed the flagged code.
- Look at what was not checked. Every advisory lists the scope of the scan, and an honest scope line is more useful than a confident verdict.
- Decide before you delete. Removing a plugin destroys the evidence you need for a report, so disable and snapshot first.
Where the version numbers come from
Advisories are generated from metadata we can verify: published versions, install scripts read as text, declaration files, and repository events. Nothing in the advisory depends on a maintainer telling us what their plugin does, which is why an advisory and a marketing page can disagree.
An advisory is a statement about one version at one point in time. Treat it as the start of a check, not the end of one.
Turning the roundup into an action
- Subscribe to the feed so the roundup arrives where your team already works, instead of depending on someone remembering to look.
- Cross-check the list against your installed set once a week. Five minutes against a known list beats an audit nobody schedules.
- Assign the follow-up to the person who approved the plugin. Approval and rollback belong to the same owner, otherwise both get deferred.
- Record the decision, including the decision to do nothing. An unrecorded choice looks like negligence six months later.
FAQ
- How is an advisory different from the quality score? The score describes health and hygiene over time; an advisory describes one finding with a timestamp.
- Does a Critical advisory mean my machine is already compromised? No. It means the version contains behaviour that can compromise a machine that installs it. Whether yours did depends on what you installed and when.
- Can a plugin clear an advisory? Yes, when the maintainer ships a fixed version and the scan of that version comes back clean. The advisory stays on the page as history.
- Should I remove every flagged plugin immediately? No. Disable and snapshot first, then decide. Removing first destroys the evidence you need if it turns out to be real.
- Why are some advisories vague? Because the scan only reports what it can verify. A vague advisory with an honest scope beats a confident one built on guesses.
Every plugin page on dshquality.com lists the advisories raised against it, including what was checked and what was not. Get the weekly roundup at /subscribe, start from the live plugin index at /, and read how the scanner reaches a verdict at /blog/how-install-script-scanning-works. The rest of the notes are at /blog.