registry / meitu-designkit-cli / 1.0.62

meitu-designkit-cli@1.0.62

CLI for DesignKit Team Agent

AI Security Review

scanned 19d ago · by lpm-firewall-ai

No confirmed attack surface was identified. The package has no automatic installation lifecycle hook, and its entrypoint is activated through the CLI.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the designkit command or imports the main entrypoint.

Impact

No confirmed unauthorized mutation, exfiltration, remote code execution, or persistence was established.

Mechanism

The bundled code processes command-line arguments and provides DesignKit CLI functionality; no verified malicious data flow was found.

AI rationale

Despite substantial obfuscation and privileged CLI primitives, the inspected manifest has no install-time trigger and the observed execution path is user-invoked. Static inspection did not establish a concrete malicious behavior or exfiltration sink.

Decision evidence

public snapshot

AI called this Clean at 78.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

The manifest exposes a CLI and library entrypoint but contains no preinstall, install, postinstall, or other lifecycle hook.
The bundled entrypoint parses process arguments and invokes its command handler, consistent with user-invoked CLI execution.
No concrete credential harvesting, unrestricted destination, payload download, or command-output send sink was established by static inspection.

meitu-designkit-cli@1.0.62

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code