registry / meitu-designkit-cli / 1.0.71

meitu-designkit-cli@1.0.71

CLI for DesignKit Team Agent

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The active CLI loads an obfuscated bundle containing network requests and process inspection. No confirmed attack was established, but destination and authorization behavior remain unresolved.

Static reason

One or more suspicious static signals were detected.

Trigger

Running designkit or importing dist/index.js loads the bundle; individual operation gates remain unresolved.

Impact

Potential exposure through network operations cannot be resolved from the inspected excerpts; actual exfiltration was not established.

Mechanism

Encoded string lookups obscure request configuration and command dispatch.

AI rationale

The active obfuscated implementation leaves material network behavior unresolved, supporting a warning rather than a clean verdict. Inspected source does not establish concrete malicious behavior sufficient to block publication.

Evidence

dist/index.js

Decision evidence

public snapshot

AI called this Suspicious at 66.0% confidence as Unknown with high false-positive risk.

Evidence for warning

The declared CLI entrypoint directly loads dist/index.js.
The bundle hides strings and property names behind an encoded lookup decoder.
The bundle sends network requests with computed headers and a serialized body; destination restrictions remain unresolved.

meitu-designkit-cli@1.0.71

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code