registry / meitu-designkit-cli / 1.0.55

meitu-designkit-cli@1.0.55

CLI for DesignKit Team Agent

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Running the designkit command loads an opaque bundle that can fetch update metadata and install a selected release globally. This is an automatic system-level package mutation, but not an install lifecycle hook.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the designkit CLI.

Impact

A remote service can select a package version that the CLI installs globally under the user's permissions.

Mechanism

Obfuscated remote version check followed by global npm self-install and process re-execution.

AI rationale

This is not a confirmed install-hook attack or credential theft, but deliberate whole-bundle obfuscation combined with automatic remote-selected global self-install is a concrete unresolved supply-chain risk.

Evidence

bin/designkit-cli.jsdist/index.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The published CLI immediately loads a heavily obfuscated dist/index.js bundle.
The bundle checks a remotely supplied version and automatically runs npm install -g meitu-designkit-cli@<version>, then re-executes itself.
The update path is reached during normal CLI execution and obscures its endpoint and control flow.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The observed network code is consistent with CLI authentication and product API calls; static inspection did not confirm secret harvesting or unrelated exfiltration.
The manifest has no runtime dependency on its own package name.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

Manifest

NoLicense

scanned 2 file(s), 1.19 MB of source

Source & flagged code

5 flagged

bin/designkit-cli.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

3require("../dist/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/designkit-cli.jsView on unpkg · L2

dist/index.jsView file

1'use strict';(function(_0x155fe9,_0x30c3f7){const _0x35d699={_0x5a1ae9:0xe89,_0x5921c4:0xa86,_0x508c5a:0x9bf,_0x17d624:0xa1c,_0x5ea3e2:0x11b1,_0x5763be:0xdfe,_0x360b32:0x83a,_0xb5c...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x155fe9,_0x30c3f7){const _0x35d699={_0x5a1ae9:0xe89,_0x5921c4:0xa86,_0x508c5a:0x9bf,_0x17d624:0xa1c,_0x5ea3e2:0x11b1,_0x5763be:0xdfe,_0x360b32:0x83a,_0xb5c...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x155fe9,_0x30c3f7){const _0x35d699={_0x5a1ae9:0xe89,_0x5921c4:0xa86,_0x508c5a:0x9bf,_0x17d624:0xa1c,_0x5ea3e2:0x11b1,_0x5763be:0xdfe,_0x360b32:0x83a,_0xb5c...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: 'use strict';(function(_0x155fe9,_0x30c3f7){const _0x35d699={_0x5a1ae9:0xe89,_0x5921c4:0xa86,_0x508c5a:0x9bf,_0x17d624:0xa1c,_0x5ea3e2:0x11b1,_0x5763be:0xdfe,_0x360b32:0x83a,_0xb5c...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1

Source & flagged code

5 flagged · loading source

bin/designkit-cli.jsView file

2L3: require("../dist/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/designkit-cli.jsView on unpkg · L2

dist/index.jsView file

1'use strict';(function(_0x155fe9,_0x30c3f7){const _0x35d699={_0x5a1ae9:0xe89,_0x5921c4:0xa86,_0x508c5a:0x9bf,_0x17d624:0xa1c,_0x5ea3e2:0x11b1,_0x5763be:0xdfe,_0x360b32:0x83a,_0xb5c...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x155fe9,_0x30c3f7){const _0x35d699={_0x5a1ae9:0xe89,_0x5921c4:0xa86,_0x508c5a:0x9bf,_0x17d624:0xa1c,_0x5ea3e2:0x11b1,_0x5763be:0xdfe,_0x360b32:0x83a,_0xb5c...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x155fe9,_0x30c3f7){const _0x35d699={_0x5a1ae9:0xe89,_0x5921c4:0xa86,_0x508c5a:0x9bf,_0x17d624:0xa1c,_0x5ea3e2:0x11b1,_0x5763be:0xdfe,_0x360b32:0x83a,_0xb5c...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1

Findings

4 High4 Medium4 Low

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated Payload Loaderdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

MediumDynamic Requirebin/designkit-cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to meitu-designkit-cli@1.0.55.

See version security history for other recorded verdicts.

Review the evidence and your use of meitu-designkit-cli@1.0.55 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-04 08:54:09.178Z (UTC).