That does work! However it does mean that the password is in clear text in a file on the desktop.
I got it to prompt the user for the password:
plink -ssh user@server "echo 'Enter dmg password: '; read -s -n 14 pass; printf $pass | hdiutil attach -stdinpass file.dmg"
I couldn't figure out how to get the shell to take the password terminated with the return key, it always wants ctrl-z so I just had it read the length of the password
Thanks so much!