Deepseek Harness For IDE

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Deepseek Harness For IDE version 0.1.22, published on the JetBrains Marketplace by miyuki and used by about 1,550 people, ships an AI coding assistant runtime. Its dependency tree lives at deepseek-harness-jetbrains/dsh-runtime/node_modules, and that tree accounts for nearly every finding in the scan.

Does the access match the job?

An assistant that explains your code, fetches pages and runs searches needs an HTTP client and a model client. The network findings land where those belong. @deepseek-ai/dsh-web-fetch-http/lib/index.js carries fetch calls at lines 161, 195, 258 and 440. @deepseek-ai/dsh-web-search-deepseek/lib/index.js:132 is the search path, and @deepseek-ai/dsh-tool-web/lib/index.js:805 exposes web retrieval as a tool the model can call. @earendil-works/pi-ai/dist/api/cloudflare-ai-binding.js:10 binds the assistant to a hosted model provider. The chat interface ships as @deepseek-ai/dsh-web-frontend/dist/assets/vendor-CCJJTK99.js:44 and index-5SrrfWpU.js:2. protobufjs/dist/light/protobuf.js:4811 is a data serializer, and its appearance in a fetch-flagged result says more about the matcher than about the package.

Credential access

Nothing here reads a secret. There are no matches against .env files, .ssh keys, .git/config, cloud credential files or any IDE secret store, and the manifest analysis returned nothing. For an extension with this much filesystem reach, that absence is the most informative result in the set. Credential theft requires touching those files, and none of the matched paths do.

Where the volume comes from

The scan produced 6,615 matches. Most are IP addresses, domains and host-like fragments pulled out of minified dependency code: 6,426 in the indicator category and 181 network references. No malware signature matched, no obfuscation was detected, and nothing executes at install time. The four code-smell hits are low severity and fire on ordinary JavaScript. Twenty items listed as network endpoints are changelog filenames like 2026-08-04-web-slash-command-fuzzy-discovery.md and 2026-09-15-shipped-optional-bundles.md, lifted from release note text.

The strongest counterargument

An assistant that reads your source and sends context to a cloud model is a channel for code to leave the machine, and that channel is real. This scan cannot confirm the destination: the endpoint list holds release-note filenames and no model hostname, so where the runtime sends data is unverified. What the scan does show is the shape of the code, and the shape is a client library pointed at a configured provider, with no hardcoded collection address and no install-time payload. Anyone who would rather not send code to DeepSeek's service should skip this extension for that reason. The decision is about which model provider you trust with your code.

Key Reasons

• All 181 network findings sit inside deepseek-harness-jetbrains/dsh-runtime/node_modules, in packages named for web fetch, web search and model provider bindings.
• Zero secret, credential or manifest findings: no .env, .ssh or cloud credential reads matched anywhere in the scan.
• No malware signature, obfuscation or tool-poisoning result; the only low-severity items are four code-smell hits on ordinary JavaScript.
• The endpoint list contains changelog filenames such as 2026-08-04-web-slash-command-fuzzy-discovery.md, which the extractor read as network hosts.
• 6,426 address and domain matches come from minified dependency bundles, including protobufjs/dist/light/protobuf.js.

False Positive Considerations

• IoC extraction over minified node_modules bundles (6,426 matches)
• Changelog markdown filenames parsed as network endpoints
• NET-FETCH matcher firing on data-format libraries such as protobufjs
• Low-severity code-smell rules matching ordinary JavaScript patterns

Reviewed 2026-10-03; recommended action: suppress false positive; model confidence 78%.