Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

meitu-designkit-cli@1.0.65: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 12 finding(s) warrant review before installing.

View on npm All versions

registry / meitu-designkit-cli / 1.0.65

meitu-designkit-cli@1.0.65

CLI for DesignKit Team Agent

AI Security Review

scanned 17d ago · by lpm-firewall-ai

No confirmed attack was identified. The opaque runtime bundle has an unresolved child-process capability related to global package installation.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the designkit CLI or a command path within its runtime bundle reaches the update behavior.

Impact

This may alter globally installed CLI software, but static inspection did not establish an automatic trigger or a concrete malicious payload.

Mechanism

The obfuscated bundle references child-process spawning and constructs arguments for a global npm installation of a meitu-design package.

AI rationale

The package has no lifecycle hook, so there is no confirmed automatic install-time attack. However, deliberate obfuscation combined with unresolved child-process and global installation behavior warrants a warning.

Evidence

dist/index.js

Decision evidence

public snapshot

AI called this Suspicious at 76.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The package exposes a user-invoked CLI entry point and declares no npm lifecycle hook.
The heavily obfuscated runtime bundle contains child-process spawning and strings for globally installing a meitu-design package.

Stop threats before they install.

Firewall

Threat feed
How it works
Policy

LPM

Evidence against

No install, preinstall, or postinstall hook is declared in package.json.
No concrete credential exfiltration, network endpoint, or destructive action was established from the inspected source.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

Manifest

NoLicense

scanned 2 file(s), 1.34 MB of source

Source & flagged code

5 flagged · loading source

bin/designkit-cli.jsView file

2L3: require("../dist/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/designkit-cli.jsView on unpkg · L2

dist/index.jsView file

1'use strict';(function(_0x4af59b,_0x36dd42){const _0x114db6={_0x4c8d79:0x559,_0x4491f8:0x748,_0xa5dbf5:0xa12,_0x4afd1e:0xedd,_0x1f79ab:0x67,_0x3f24a0:0x891,_0x2877c7:0x86f,_0xc5b4f...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x4af59b,_0x36dd42){const _0x114db6={_0x4c8d79:0x559,_0x4491f8:0x748,_0xa5dbf5:0xa12,_0x4afd1e:0xedd,_0x1f79ab:0x67,_0x3f24a0:0x891,_0x2877c7:0x86f,_0xc5b4f...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x4af59b,_0x36dd42){const _0x114db6={_0x4c8d79:0x559,_0x4491f8:0x748,_0xa5dbf5:0xa12,_0x4afd1e:0xedd,_0x1f79ab:0x67,_0x3f24a0:0x891,_0x2877c7:0x86f,_0xc5b4f...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: 'use strict';(function(_0x4af59b,_0x36dd42){const _0x114db6={_0x4c8d79:0x559,_0x4491f8:0x748,_0xa5dbf5:0xa12,_0x4afd1e:0xedd,_0x1f79ab:0x67,_0x3f24a0:0x891,_0x2877c7:0x86f,_0xc5b4f...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1

Findings

4 High4 Medium4 Low

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated Payload Loaderdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

MediumDynamic Requirebin/designkit-cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to meitu-designkit-cli@1.0.65.

See version security history for other recorded verdicts.

Review the evidence and your use of meitu-designkit-cli@1.0.65 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 04:54:03.096Z (UTC).

76%Suspicious

AI assessment confidence

IntentUnknown

TypeUnknown

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Maintainersmeitu.inc

Version1.0.65

Latest on npm1.0.71

PublishedSep 18, 2026

LicenseUNLICENSED

Dependencies3

Integrityverified

Package size485 KB

Files5

Runtime surface

package.json

Entrypointsmain → dist/index.jsbin → designkit

Runtimenode >=18.0.0

Artifact1.35 MB · 5 files2 signature(s)

Install lifecycleNo install hooks · other: build, build:beta, build:doubao-scenes, build:meitu-int +8

Behavioral surface

DynamicRequireEnvironmentVarsFilesystemNetworkHighEntropyStringsMinifiedPossibleObfuscationTrivialNoLicense

LPM.dev Registry

© 2026 LPM

Source & flagged code

5 flagged

bin/designkit-cli.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

2

3require("../dist/index.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/designkit-cli.jsView on unpkg · L2

4

dist/index.jsView file

1'use strict';(function(_0x4af59b,_0x36dd42){const _0x114db6={_0x4c8d79:0x559,_0x4491f8:0x748,_0xa5dbf5:0xa12,_0x4afd1e:0xedd,_0x1f79ab:0x67,_0x3f24a0:0x891,_0x2877c7:0x86f,_0xc5b4f...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x4af59b,_0x36dd42){const _0x114db6={_0x4c8d79:0x559,_0x4491f8:0x748,_0xa5dbf5:0xa12,_0x4afd1e:0xedd,_0x1f79ab:0x67,_0x3f24a0:0x891,_0x2877c7:0x86f,_0xc5b4f...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1'use strict';(function(_0x4af59b,_0x36dd42){const _0x114db6={_0x4c8d79:0x559,_0x4491f8:0x748,_0xa5dbf5:0xa12,_0x4afd1e:0xedd,_0x1f79ab:0x67,_0x3f24a0:0x891,_0x2877c7:0x86f,_0xc5b4f...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: 'use strict';(function(_0x4af59b,_0x36dd42){const _0x114db6={_0x4c8d79:0x559,_0x4491f8:0x748,_0xa5dbf5:0xa12,_0x4afd1e:0xedd,_0x1f79ab:0x67,_0x3f24a0:0x891,_0x2877c7:0x86f,_0xc5b4f...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1