registry / meitu-designkit-cli / 1.0.57

meitu-designkit-cli@1.0.57

CLI for DesignKit Team Agent

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Running the designkit command loads an opaque runtime that can invoke npm to globally install another release of itself. There is no install-time lifecycle trigger.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the designkit executable or imports dist/index.js.

Impact

The package can replace or install its CLI globally, while its obfuscation makes the exact activation path difficult to verify.

Mechanism

Obfuscated CLI runtime with self-install capability.

AI rationale

No concrete theft, destructive action, or install-hook abuse was confirmed, but deliberate obfuscation combined with runtime self-installation leaves a material unresolved risk. Downgrade to a warning rather than blocking because the observed behavior is user-runtime activated and lacks an install lifecycle hook.

Evidence

bin/designkit-cli.jsdist/index.js

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The published runtime is heavily obfuscated and includes a string-decoding loader, preventing normal source auditing.
The runtime contains code to spawn npm with a global installation of meitu-designkit-cli at a selected version.

meitu-designkit-cli@1.0.57

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code