Loading npm security reports…
CLI for DesignKit Team Agent
Running the CLI can query for an update and then globally install a server-selected release of the same package. The obfuscated runtime also fingerprints AI-agent-related environment and process state.
Package source references dynamic require/import behavior.
bin/designkit-cli.jsView on unpkg · L2A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L1Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L1Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.jsView on unpkg · L1A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L1It automatically runs npm to globally install another version of itself selected at runtime.
dist/index.jsView on unpkg · L1This report applies to meitu-designkit-cli@1.0.58.
See version security history for other recorded verdicts.
Evidence last updated: .
Package source references dynamic require/import behavior.
bin/designkit-cli.jsView on unpkg · L2A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L1Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L1Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.jsView on unpkg · L1A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L1It automatically runs npm to globally install another version of itself selected at runtime.
dist/index.jsView on unpkg · L1