What it may solve
Standards-based OIDC identity, enterprise API-key binding, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness
Imported third-party catalog description; not a Registry verification conclusion.Standards-based OIDC identity, enterprise API-key binding, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness
Author: freedomkk-qfeng · Tools & Capabilities · Catalog snapshot: 2026-09-19Canonical semantic path
Standards-based OIDC identity, enterprise API-key binding, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness
Imported third-party catalog description; not a Registry verification conclusion.— stars · 0 downloads
Signals were provided by the source catalog and do not imply quality or safety. 2026-09-19Active analysis coverage 5/5. Historical chains are retained but do not count toward current coverage.
Conclusion: The source structure check completed without finding a structural issue.
Conclusion: The GitHub repository is reachable and not archived. Public data: 1 stars, 17 commits, 0 forks, and 0 watches; latest commit 2026-09-06.
Conclusion: Resolved npm release 0.1.0-alpha.10, published 2026-08-31, license MIT. This release is deprecated: Moved to @eduwork/dsh-oidc. Use @eduwork/dsh-oidc@0.1.0 with DSH 0.1.2-rc.1. Back up your Profile and update package references; see https://github.com/freedomkk-qfeng/dsh-oidc/blob/main/docs/EDUWORK-MIGRATION.en.md. Existing versions remain available..
Conclusion: Compatibility verification passed. Installation, profile loading, and sustained startup all completed. Test environment: DSH 0.1.6-alpha.2, web profile.
Conclusion: This bounded audit reported 0 known vulnerabilities. It covers only the locked versions and audit source; zero reports is not proof of safety.
The plugin’s advertised feature has not been automatically verified. Passing installation and startup does not prove that feature works.
Conclusion: The scan found 5 characteristics that need attention: declares a prepare script, normally used when building or publishing the package, contains credential or token handling code, may execute dynamically constructed code, may read environment variables, may access the network. This is a bounded automated observation, not a determination of malicious intent.
Conclusion: Package name, version, entrypoints, and checksum passed validation. Artifact: dsh-oidc@0.1.0-alpha.10; SHA-256: 294de9e69a2ea6dcefc5f4d4783b400140fa464c9fd6e71f8e4a0763a41220af.
Automated evidence is scoped to the named artifact, DSH target and profile. It is not a blanket safety or feature-completeness claim.
Describe your task in a DSH conversation and mention dsh-oidc. After installing or updating the manager from npm latest, it can find this candidate through Registry, then inspect its actual source and version locally.
dsh-oidcAnalyzed 0.1.0-alpha.10github:freedomkk-qfeng/dsh-oidcExact version not resolved