DSH plugins hit 2,560 confirmed entries in three days

AdamPlatin123's radar repo confirmed 2,560 of 2,855 candidate DSH plugins in 72 hours, according to its GitHub page. Anyone who installs one runs the plugin's code with full permissions. Only 860 of the 1,305 plugins tested so far pass as safe to run, and 394 are flagged outright incompatible.

That gap between confirmed and tested matters: some plugins sit indexed and unverified while people install them anyway, trusting the confirmed count alone.

The repo scans GitHub every six hours and dynamically tests each plugin on a Kubernetes cluster. Most of the 2,855 indexed candidates are still waiting on that test to run.

The curated companion list, which has 4,049 stars, opens with a direct warning: tool approval doesn't sandbox plugin code.

Package management solved this problem before, with lockfiles, signatures, and scanning built in. None of that exists three days into this one.

The GitHub page doesn't say who runs the test cluster or what it checks beyond runtime compatibility. A plugin can pass that test and still misuse the access it's granted. The repo's own numbers don't rule that out.