Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

meitu-designkit-cli@1.0.60: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 12 finding(s) warrant review before installing.

View on npm All versions

registry / meitu-designkit-cli / 1.0.60

meitu-designkit-cli@1.0.60

CLI for DesignKit Team Agent

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Running or importing the CLI loads an opaque entrypoint that can read environment data, make network requests, and spawn processes. It also contains code to invoke a global npm installation, but the target is obscured.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the designkit command or imports dist/index.js.

Impact

The opaque implementation prevents reliable verification of what data is sent or which package is installed.

Mechanism

Obfuscated CLI code performs environment-aware network and process operations.

AI rationale

This release has no install lifecycle hook or self-dependency, so there is no concrete automatic install-time attack. However, its intentionally opaque runtime combines sensitive primitives and an obscured global npm-install path, leaving a real unresolved risk.

Evidence

dist/index.jsbin/designkit-cli.js

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The manifest exposes an executable CLI whose main module is dist/index.js.
The 1.36 MB dist entrypoint is deliberately obfuscated and combines environment access, fetch requests, filesystem access, and child-process spawning.

Stop threats before they install.

Firewall

Threat feed
How it works
Policy

LPM

The obfuscated code includes a spawnSync call that runs a global npm install; its constructed package argument is not auditable from the published source.

Evidence against

package.json contains no preinstall, install, postinstall, or prepare lifecycle hook.
No self-dependency is declared.
No plaintext credential-file harvesting, shell payload, or fixed external endpoint was established by source inspection.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

Manifest

NoLicense

scanned 2 file(s), 1.30 MB of source

Source & flagged code

5 flagged · loading source

bin/designkit-cli.jsView file

2L3: require("../dist/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/designkit-cli.jsView on unpkg · L2

dist/index.jsView file

1'use strict';(function(_0x214912,_0x101c1e){const _0x1dea1e={_0x356900:0x4cd,_0x3c22e0:0x236,_0x31573a:0x535,_0x27b763:0xfcd,_0x18279c:0x9ab,_0x381908:0xa73,_0x3317a9:0x510,_0x660e...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x214912,_0x101c1e){const _0x1dea1e={_0x356900:0x4cd,_0x3c22e0:0x236,_0x31573a:0x535,_0x27b763:0xfcd,_0x18279c:0x9ab,_0x381908:0xa73,_0x3317a9:0x510,_0x660e...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x214912,_0x101c1e){const _0x1dea1e={_0x356900:0x4cd,_0x3c22e0:0x236,_0x31573a:0x535,_0x27b763:0xfcd,_0x18279c:0x9ab,_0x381908:0xa73,_0x3317a9:0x510,_0x660e...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: 'use strict';(function(_0x214912,_0x101c1e){const _0x1dea1e={_0x356900:0x4cd,_0x3c22e0:0x236,_0x31573a:0x535,_0x27b763:0xfcd,_0x18279c:0x9ab,_0x381908:0xa73,_0x3317a9:0x510,_0x660e...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1

Findings

4 High4 Medium4 Low

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated Payload Loaderdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

MediumDynamic Requirebin/designkit-cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to meitu-designkit-cli@1.0.60.

See version security history for other recorded verdicts.

Review the evidence and your use of meitu-designkit-cli@1.0.60 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 12:19:33.370Z (UTC).

83%Suspicious

AI assessment confidence

IntentUnknown

TypeUnknown

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Maintainersmeitu.inc

Version1.0.60

Latest on npm1.0.71

PublishedSep 14, 2026

LicenseUNLICENSED

Dependencies3

Integrityverified

Package size472 KB

Files5

Runtime surface

package.json

Entrypointsmain → dist/index.jsbin → designkit

Runtimenode >=18.0.0

Artifact1.31 MB · 5 files1 signature(s)

Install lifecycleNo install hooks · other: build, build:beta, build:meitu-int, build:pre +8

Behavioral surface

DynamicRequireEnvironmentVarsFilesystemNetworkHighEntropyStringsMinifiedPossibleObfuscationTrivialNoLicense

LPM.dev Registry

© 2026 LPM

Source & flagged code

5 flagged

bin/designkit-cli.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

2

3require("../dist/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/designkit-cli.jsView on unpkg · L2

4

dist/index.jsView file

1'use strict';(function(_0x214912,_0x101c1e){const _0x1dea1e={_0x356900:0x4cd,_0x3c22e0:0x236,_0x31573a:0x535,_0x27b763:0xfcd,_0x18279c:0x9ab,_0x381908:0xa73,_0x3317a9:0x510,_0x660e...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x214912,_0x101c1e){const _0x1dea1e={_0x356900:0x4cd,_0x3c22e0:0x236,_0x31573a:0x535,_0x27b763:0xfcd,_0x18279c:0x9ab,_0x381908:0xa73,_0x3317a9:0x510,_0x660e...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x214912,_0x101c1e){const _0x1dea1e={_0x356900:0x4cd,_0x3c22e0:0x236,_0x31573a:0x535,_0x27b763:0xfcd,_0x18279c:0x9ab,_0x381908:0xa73,_0x3317a9:0x510,_0x660e...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: 'use strict';(function(_0x214912,_0x101c1e){const _0x1dea1e={_0x356900:0x4cd,_0x3c22e0:0x236,_0x31573a:0x535,_0x27b763:0xfcd,_0x18279c:0x9ab,_0x381908:0xa73,_0x3317a9:0x510,_0x660e...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1