# "DSH Plugin Security Scanner: 5 Red Flags Before You Install"


**canonical_url:** https://dshquality.com/blog/dsh-plugin-security-scanner-guide

When was the last time you actually read what a plugin does before installing it? Most developers click "install" without a second thought. But every plugin you add is third-party code running in your environment—and that's a security decision, not just a convenience.

This is where the **DSH Quality Score** comes in. It's an independent scoring system that evaluates plugins across maintenance health, documentation quality, npm ecosystem integration, and—most importantly—security posture.

## The Problem: 35% of Plugins Are Risky

Looking at the current plugin rankings, here's what the distribution looks like:

- **A-grade (excellent):** 4 plugins
- **B-grade (good):** 4 plugins
- **C-grade (acceptable with caveats):** 6 plugins
- **D-grade (high risk):** 7 plugins

That's a **35% risk rate** among evaluated plugins. Not something you want to ignore.

## The Three Red Flags You Can't Skip

### 1. Missing dsh.bundle Declaration

This is the most common warning. Over half the D-grade plugins lack a proper bundle declaration, which means the plugin's package structure hasn't been audited. Without it, you have no guarantee the package is self-contained or that dependencies are properly scoped.

**What to do:** If a plugin says "missing dsh.bundle declaration," don't use it unless you've manually verified its source code.

### 2. Dangerous Install Scripts

This is the highest-risk warning. Some plugins include post-install scripts that execute arbitrary commands on your machine. These can range from harmless housekeeping to outright malicious code.

**What to do:** Any plugin flagged with "dangerous install script" should be treated as a hard no for production use. Period.

### 3. Stale Maintenance

A plugin that hasn't been pushed in 30+ days may have unpatched vulnerabilities. Security updates don't happen automatically—they require active maintenance.

**What to do:** Check the "last push" date. If a critical plugin is stale, find an actively maintained alternative.

## How to Use the Scanner: A Practical Walkthrough

Let's look at the top-ranked plugins and what their scores tell us:

**Rank #1: dsh-core (A, Score 92)**
- Stars: 2.0k
- Last push: 1 day ago
- Security: None
- *Verdict:* Excellent. Actively maintained, no warnings.

**Rank #4: dsh-memory-store (A, Score 84)**
- Stars: 876
- Last push: 4 days ago
- Security: None
- *Verdict:* Strong. Good alternative for state management needs.

**Rank #18: dsh-miner (D, Score 12)**
- Stars: 12
- Last push: 1 month ago
- Security: Dangerous install script
- *Verdict:* Do not install. High risk, minimal adoption.

**Rank #19: dsh-telemetry (D, Score 18)**
- Stars: 8
- Last push: 1 month ago
- Security: Dangerous install script
- *Verdict:* Do not install. Telemetry plugins with dangerous scripts are especially risky.

## The Bottom Line

Here's what I've learned from reviewing hundreds of plugin evaluations: **the DSH Quality Score is the fastest way to separate safe tools from potential threats.**

It takes about 30 seconds to check a plugin's grade and security warnings. That's 30 seconds you should invest before every installation.

If you're serious about workspace security, make the **dsh plugin security scanner** part of your routine. Your future self—and your production environment—will thank you.

*Want to check a specific plugin? Visit dshquality.com and run the scan. Independent scoring, real-time security warnings, no gatekeeping.*