dsh-plugin-developer

This is a project and ffmpeg self-test, not evidence of malware. Its main security risk is destructive: it recursively deletes the path supplied as process.argv[2] (or the default D:\\dsh-research\\.selftest) without validating that it is a safe test directory. It also prints Dreamina account display name and credit count locally; no exfiltration destination is shown. Severity is moderate because an unintended path argument can cause data loss.

This script replaces the lib directory and overwrites cordis.patch.yml and package.json in existing .dsh profile installations of @demo/weather-plugin. Its filesystem writes are destructive and could install altered plugin code, but no payload, credential theft, network exfiltration, or other direct malicious behavior is shown in this fragment. Severity is moderate pending verification that the source files and intended synchronization are trusted.