Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

meitu-designkit-cli@1.0.30: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 12 finding(s) warrant review before installing.

View on npm All versions

registry / meitu-designkit-cli / 1.0.30

meitu-designkit-cli@1.0.30

CLI for DesignKit Team Agent

AI Security Review

scanned 17d ago · by lpm-firewall-ai

No confirmed attack surface was established. The user-invoked CLI executes opaque, obfuscated code that can inspect running processes.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the designkit CLI or importing its main entrypoint.

Impact

The opaque runtime behavior creates unresolved execution and local-process inspection risk, but no confirmed harmful action was identified.

Mechanism

The bundle loads child-process and filesystem functionality and invokes a process-listing command through obfuscated code.

AI rationale

The absence of install hooks rules out an automatic install attack, but the intentionally opaque active CLI includes unexplained local process execution. There is insufficient source evidence to classify it as malicious or clean.

Evidence

dist/index.js

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The manifest exposes a CLI and main entrypoint but declares no npm preinstall, install, postinstall, or prepare hook.
The active distribution bundle is heavily obfuscated and imports process-execution and filesystem modules.

Stop threats before they install.

Firewall

Threat feed
How it works
Policy

LPM

When the CLI runs, bundle code invokes a process-listing command, which is not explained by the small manifest.

Evidence against

No install-time lifecycle hook is present in the inspected manifest.
Static inspection did not establish credential collection, an unrestricted destination, destructive behavior, or a completed exfiltration path.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

Manifest

NoLicense

scanned 2 file(s), 1.07 MB of source

Source & flagged code

5 flagged · loading source

bin/designkit-cli.jsView file

2L3: require("../dist/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/designkit-cli.jsView on unpkg · L2

dist/index.jsView file

1'use strict';(function(_0x47aa4d,_0x2da240){const _0x1359cf={_0x45cc74:0xb56,_0x4ff092:0x669,_0x4055af:0x468,_0x362b3c:0x826,_0xa3f5d1:0x440,_0x418fd2:0x692,_0xeef5b3:0xbbc,_0x55c0...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x47aa4d,_0x2da240){const _0x1359cf={_0x45cc74:0xb56,_0x4ff092:0x669,_0x4055af:0x468,_0x362b3c:0x826,_0xa3f5d1:0x440,_0x418fd2:0x692,_0xeef5b3:0xbbc,_0x55c0...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x47aa4d,_0x2da240){const _0x1359cf={_0x45cc74:0xb56,_0x4ff092:0x669,_0x4055af:0x468,_0x362b3c:0x826,_0xa3f5d1:0x440,_0x418fd2:0x692,_0xeef5b3:0xbbc,_0x55c0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: 'use strict';(function(_0x47aa4d,_0x2da240){const _0x1359cf={_0x45cc74:0xb56,_0x4ff092:0x669,_0x4055af:0x468,_0x362b3c:0x826,_0xa3f5d1:0x440,_0x418fd2:0x692,_0xeef5b3:0xbbc,_0x55c0...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1

Findings

4 High4 Medium4 Low

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated Payload Loaderdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

MediumDynamic Requirebin/designkit-cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to meitu-designkit-cli@1.0.30.

See version security history for other recorded verdicts.

Review the evidence and your use of meitu-designkit-cli@1.0.30 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 04:53:41.284Z (UTC).

78%Suspicious

AI assessment confidence

IntentUnknown

TypeUnknown

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Maintainersmeitu.inc

Version1.0.30

Latest on npm1.0.71

PublishedAug 26, 2026

LicenseUNLICENSED

Dependencies2

Integrityverified

Package size392 KB

Files5

Runtime surface

package.json

Entrypointsmain → dist/index.jsbin → designkit

Runtimenode >=18.0.0

Artifact1.08 MB · 5 files1 signature(s)

Install lifecycleNo install hooks · other: build, build:beta, build:meitu-int, build:pre +8

Behavioral surface

DynamicRequireEnvironmentVarsFilesystemNetworkHighEntropyStringsMinifiedPossibleObfuscationTrivialNoLicense

LPM.dev Registry

© 2026 LPM

Source & flagged code

5 flagged

bin/designkit-cli.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

2

3require("../dist/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/designkit-cli.jsView on unpkg · L2

4

dist/index.jsView file

1'use strict';(function(_0x47aa4d,_0x2da240){const _0x1359cf={_0x45cc74:0xb56,_0x4ff092:0x669,_0x4055af:0x468,_0x362b3c:0x826,_0xa3f5d1:0x440,_0x418fd2:0x692,_0xeef5b3:0xbbc,_0x55c0...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x47aa4d,_0x2da240){const _0x1359cf={_0x45cc74:0xb56,_0x4ff092:0x669,_0x4055af:0x468,_0x362b3c:0x826,_0xa3f5d1:0x440,_0x418fd2:0x692,_0xeef5b3:0xbbc,_0x55c0...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x47aa4d,_0x2da240){const _0x1359cf={_0x45cc74:0xb56,_0x4ff092:0x669,_0x4055af:0x468,_0x362b3c:0x826,_0xa3f5d1:0x440,_0x418fd2:0x692,_0xeef5b3:0xbbc,_0x55c0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: 'use strict';(function(_0x47aa4d,_0x2da240){const _0x1359cf={_0x45cc74:0xb56,_0x4ff092:0x669,_0x4055af:0x468,_0x362b3c:0x826,_0xa3f5d1:0x440,_0x418fd2:0x692,_0xeef5b3:0xbbc,_0x55c0...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1