registry / meitu-designkit-cli / 1.0.63

meitu-designkit-cli@1.0.63

CLI for DesignKit Team Agent

AI Security Review

scanned 19d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Launching the CLI executes an extensively obfuscated bundle before command parsing, leaving its effective behavior unresolved.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the designkit CLI or imports its declared main entrypoint.

Impact

Potential harmful behavior cannot be ruled out by static inspection, but no concrete exfiltration, payload execution, persistence, or destructive action was verified.

Mechanism

The opaque bundle imports process-execution capabilities and initializes code before parsing command arguments.

AI rationale

No concrete malicious chain was proven, but the executable’s deliberate whole-program obfuscation and pre-argument initialization create unresolved security risk. The absence of install hooks and confirmed harmful sinks makes blocking unsupported.

Evidence

dist/index.js

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The manifest exposes the opaque bundled file as both the module entrypoint and CLI implementation.
The CLI entrypoint is a 1.4 MB single-line control-flow-obfuscated program that imports process-execution facilities, preventing a reliable source-level audit of its reachable behavior.

meitu-designkit-cli@1.0.63

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code