awesome-dsh-plugin +1,245, Delists Miner (Oct 28, 2026)

awesome-dsh-plugin Adds 1,245 Entries in Seven Days, Delists a Postinstall-Miner Plugin and Crosses 7,500.

The previous window closed at 20:24 UTC on October 21. The seven days that followed were the largest stretch this site has covered: 1,245 new plugin entries between 2026-10-21 20:24:22 UTC and 2026-10-28 20:24:28 UTC — every previously covered window topped out at the 296-addition day of October 16 — plus a security delist with a postinstall miner behind it and a decay wave bigger than any recorded in the list’s cloned history. The data/plugins tree crossed 7,500 on the way, ending at 7,552 entries.

Seven days, six evening bursts

The window holds 2,147 commits, of which 648 are the automated regenerate READMEs from data/plugins chores. The additions did not arrive as one wave but as six recurring evening bursts — 781 of the 1,245 entries — each opening within about six minutes of 17:00 UTC: 107 entries on October 22, 96 on the 23rd, 66 on the 24th (an evening that kept going in later waves past 23:34 and across midnight), then the week’s peak — 262 entries in 46 minutes (17:00:32–17:45:55) on October 26 — 135 on the 27th and 115 on the 28th. October 25 was the quiet day: 21 additions, all before 02:00 UTC. Per UTC day the additions ran 191, 141, 173, 21, 330, 234 and 153.

The arithmetic closes: 6,376 entries at the opening boundary, 7,552 at the last commit — the +1,176 net is exactly the 1,245 additions minus 69 deletions. Between bursts, the list also kept its existing entries honest: 350 commits modified 527 distinct entries, and four entries repaired from YAML parse failures landed on the evening of October 28.

A delist with a miner behind it

The window’s removals are news of their own: 69 entries deleted across 23 commits, 57 of them delisted across 11 commits — the rest are rename pairs that re-add under a new name. The one that stands out is walkzzz/dsh-plugin-blender-3d, removed 2026-10-27 16:40:43 UTC citing issue #9969. Per the issue, the plugin’s npm release dsh-plugin-blender-3d@0.2.1 — published 2026-10-26 00:55:25 UTC per the issue’s npm metadata probe — added a postinstall hook running scripts/miner.sh, which downloads a second-stage payload from S3: XMRig on non-root hosts, an attempt at a persistent agent on root or passwordless-sudo hosts. The reporter’s analysis was static and the payload was not executed; the 0.2.0→0.2.1 diff touched only package.json and the new script. The trap the issue documents: the list’s YAML pinned the clean GitHub v0.2.0 tarball, but npm installs 0.2.1 exactly.

The other headline removal is pure decay: 37 entries whose repository is gone and whose npm fallback is dead, deleted in one commit at 2026-10-27 20:12:49 UTC — the largest single-commit removal in the list’s history as far as this article’s full-clone scan reaches (the previous record: the 16-gone wave of October 18; every earlier wave sat at 11 or fewer). An 11-entry wave labeled the 2026-10-27 decay window had landed the evening before. The remaining delists are singles: an author request, an archived repo, a deleted repository, a listing going private, one superseded by the built-in scheduler, one discontinued plugin, one deprecated entry and one cleanup.

The same-name hazard, still on schedule

Both fronts this series tracks grew. Entries named exactly dsh-session-delete went from 14 to 16 — Linusteller’s at 23:32:47 UTC on October 21 and FunnyDiodio’s at 17:25:25 UTC on October 28, joining the eight this series counted on October 17 and the fourteen at this window’s opening boundary. Entries named exactly dsh-memory went from 12 to 14, adding JOJO-Adam’s and Kagurazaka135’s — and the latter is a name this map already carries: the dsh-memory (cited memory) entry here indexes Jesse-njx/dsh-memory, an unrelated project.

One more signal that the ecosystem tracks upstream closely: four market entries were updated for DSH 0.2.1-rc.3 the same morning UTC — OMD to 1.2.1, Response ID Reuse to 0.1.4, DSH Theme to 0.3.0, OpenCU to 2.2.3 — the same rc.3 today’s upstream article resumes this site’s coverage with.

Seven days, six evening bursts

A delist with a miner behind it

The same-name hazard, still on schedule

More in this series