meitu-designkit-cli@1.0.10: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

meitu-designkit-cli@1.0.10: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

bin/designkit-cli.jsView file

2L3: require("../dist/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/designkit-cli.jsView on unpkg · L2

dist/index.jsView file

1'use strict';(function(_0x5c3b9e,_0x498993){const _0x31c568={_0xb2cb2d:0xba2,_0x3ba26f:0x263,_0x25f190:0x49d,_0x3e2d64:0x3e4,_0x535c06:0xcaa,_0x44fec7:0x10d1,_0x3e662c:0x9e7,_0x5a6...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x5c3b9e,_0x498993){const _0x31c568={_0xb2cb2d:0xba2,_0x3ba26f:0x263,_0x25f190:0x49d,_0x3e2d64:0x3e4,_0x535c06:0xcaa,_0x44fec7:0x10d1,_0x3e662c:0x9e7,_0x5a6...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x5c3b9e,_0x498993){const _0x31c568={_0xb2cb2d:0xba2,_0x3ba26f:0x263,_0x25f190:0x49d,_0x3e2d64:0x3e4,_0x535c06:0xcaa,_0x44fec7:0x10d1,_0x3e662c:0x9e7,_0x5a6...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: 'use strict';(function(_0x5c3b9e,_0x498993){const _0x31c568={_0xb2cb2d:0xba2,_0x3ba26f:0x263,_0x25f190:0x49d,_0x3e2d64:0x3e4,_0x535c06:0xcaa,_0x44fec7:0x10d1,_0x3e662c:0x9e7,_0x5a6...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x5c3b9e,_0x498993){const _0x31c568={

Medium

Ai Review Evidence

The executable bundle is heavily control-flow and string obfuscated, preventing static verification of its filesystem, process, and HTTP behavior.

dist/index.jsView on unpkg · L1

Source & flagged code

6 flagged

bin/designkit-cli.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

2

3require("../dist/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/designkit-cli.jsView on unpkg · L2

4

dist/index.jsView file

1'use strict';(function(_0x5c3b9e,_0x498993){const _0x31c568={_0xb2cb2d:0xba2,_0x3ba26f:0x263,_0x25f190:0x49d,_0x3e2d64:0x3e4,_0x535c06:0xcaa,_0x44fec7:0x10d1,_0x3e662c:0x9e7,_0x5a6...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x5c3b9e,_0x498993){const _0x31c568={_0xb2cb2d:0xba2,_0x3ba26f:0x263,_0x25f190:0x49d,_0x3e2d64:0x3e4,_0x535c06:0xcaa,_0x44fec7:0x10d1,_0x3e662c:0x9e7,_0x5a6...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x5c3b9e,_0x498993){const _0x31c568={_0xb2cb2d:0xba2,_0x3ba26f:0x263,_0x25f190:0x49d,_0x3e2d64:0x3e4,_0x535c06:0xcaa,_0x44fec7:0x10d1,_0x3e662c:0x9e7,_0x5a6...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: 'use strict';(function(_0x5c3b9e,_0x498993){const _0x31c568={_0xb2cb2d:0xba2,_0x3ba26f:0x263,_0x25f190:0x49d,_0x3e2d64:0x3e4,_0x535c06:0xcaa,_0x44fec7:0x10d1,_0x3e662c:0x9e7,_0x5a6...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x5c3b9e,_0x498993){const _0x31c568={

Medium

Ai Review Evidence

The executable bundle is heavily control-flow and string obfuscated, preventing static verification of its filesystem, process, and HTTP behavior.

dist/index.jsView on unpkg · L1