registry / @oxiaom/adoremix / 1.0.55

@oxiaom/adoremix@1.0.55

AdoreMix broadcast server - cross-platform installer, runner and service manager

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Running adoremix config-manager install, then accessing port 9877.

Impact

A network client can retrieve a QQ client secret and alter agent model settings or API keys.

Mechanism

Unauthenticated OpenClaw configuration management service.

Rationale

The package does not show automatic malicious install behavior, but its opt-in persistent web manager exposes and mutates a root-owned AI-agent configuration without authentication. This is a concrete high-risk capability and vulnerability.

Evidence

src/cli.jssrc/config-manager.jsconfig-manager/app.py/root/.openclaw/openclaw.json/etc/systemd/system/config-manager.service

Network endpoints1

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

The explicit config-manager install command creates a persistent management service.
That service reads and returns an OpenClaw QQ client secret from the root-owned configuration.
It also accepts model settings and API keys, writes them to OpenClaw configuration, and listens on all IPv6 interfaces without authentication.

Evidence against

The postinstall hook only prints next-step instructions; it does not install or start the management service.
The risky setup is reached through an explicit CLI command, not automatically during package installation.
No source evidence shows secret exfiltration or unrelated payload execution.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 88 file(s), 2.84 MB of source, external domains: 127.0.0.1, api.minimaxi.com, archive.ubuntu.com, cdn.example.com, cdn.your.com, codeload.github.com, example.com, ghproxy.cn, github.com, hub.fastgit.xyz, ports.ubuntu.com, pypi.tuna.tsinghua.edu.cn, registry.npmjs.org, registry.npmmirror.com, vuejs.org, www.mp3dev.org, www.w3.org, xxx.mp3

Source & flagged code

22 flagged

package.jsonView file

Lines 16-55json

16 "@oxiaom/adoremix-linux-arm64": "^1.0.0",

17 "@oxiaom/adoremix-linux-arm": "^1.0.0",

18 "@oxiaom/adoremix-darwin-arm64": "^1.0.0"

19 },

20 "dependencies": {

21 "commander": "^12.1.0",

22 "ini": "^4.1.3",

23 "pidusage": "^3.0.2",

24 "fs-extra": "^11.2.0",

25 "prompts": "^2.4.2"

26 },

27 "peerDependencies": {

28 "node-windows": "^1.0.0-beta.8"

29 },

30 "peerDependenciesMeta": {

31 "node-windows": {

32 "optional": true

33 }

34 },

35 "scripts": {

36 "postinstall": "node ./bin/postinstall-hint.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 },

38 "files": [

39 "bin",

40 "src",

41 "templates",

42 "tts",

43 "webui",

44 "config-manager"

45 ],

46 "keywords": [

47 "adoremix",

48 "broadcast",

49 "server",

50 "qt",

51 "installer"

52 ],

53 "license": "MIT"

54}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

tts/providers/edge.jsView file

Lines 1-31javascript

1'use strict';

3/**

4 * Edge TTS provider（免费）

5 * 调用方式：python edge-tts 包 + ffmpeg 转 mp3

6 * 凭证：不需要（免费）

7 *

8 * 依赖：python3 + pip install edge-tts + ffmpeg

9 * 自动检测：adoremix tts deps

10 */

12const { execFileSync } = require('child_process');

13const fs = require('fs');

High

Child Process

Package source references child process execution.

tts/providers/edge.jsView on unpkg · L11

14const path = require('path');

15const os = require('os');

17// 短名 → edge-tts voice 全名

18// 注意：edge-tts 的 zh-CN voice 实际只有 8 个（--list-voices 确认）：

19// 女声 XiaoxiaoNeural(晓晓) XiaoyiNeural(晓伊)

20// 男声 YunxiNeural(云希) YunjianNeural(云健) YunxiaNeural(云夏) YunyangNeural(云扬)

21// 方言 liaoning-XiaobeiNeural shaanxi-XiaoniNeural

22// 讯飞/Qt 传的很多短名在 edge 无对应，就近映射到同性别有效 voice；

23// synthesize 另有 fallback 兜底（voice 调用失败回落 XiaoxiaoNeural）。

24const VOICES = {

25 // 直接对应

26 xiaoxiao: 'zh-CN-XiaoxiaoNeural',

27 xiaoyi: 'zh-CN-XiaoyiNeural',

28 yunxi: 'zh-CN-YunxiNeural',

29 yunjian: 'zh-CN-YunjianNeural',

30 yunxia: 'zh-CN-YunxiaNeural',

31 yunyang: 'zh-CN-YunyangNeural',

tts/providers/audio8.jsView file

Lines 1-28javascript

1'use strict';

3/**

4 * Audio8 TTS provider

5 * 调用方式：HTTP 调用本地 Audio8 TTS 服务（OpenAI 兼容 /v1/audio/speech）

6 * 支持流式 MP3 输出（设备边收边播，匹配现有 quemp3 推送管道）

7 *

8 * 服务部署参考（Audio8-AI/Audio8_TTS）：

9 * git clone https://github.com/Audio8-AI/Audio8_TTS.git ~/audio8

10 * cd ~/audio8/onnx_runtime && python3 -m venv .venv && . .venv/bin/activate

11 * pip install -r requirements.txt # torch/transformers/onnxruntime 等

12 * bash start_server.sh # 默认监听 http://0.0.0.0:8024

13 * 首次启动自动从 HuggingFace 下载 ~572MB 模型(0.1B-INT8)

14 *

15 * 凭证：不需要 API Key（本地服务）

16 * 依赖：lame（mp3 转码），ffmpeg（HTTP 流 → mp3）

17 *

18 * 速度支持：x-speed 头（0.5~2.0，1.0=正常；2.0=2x 加速）

19 * 声音克隆：3~10 秒参考音频，但需在 Audio8 服务端预设（请求时用 voice 参数指定）

20 */

22const { execFileSync, execSync } = require('child_process');

23const fs = require('fs');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

tts/providers/audio8.jsView on unpkg · L8

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

tts/providers/audio8.jsView on unpkg · L8

24const path = require('path');

25const os = require('os');

26const https = require('https');

27const http = require('http');

28const { URL } = require('url');

Lines 195-235javascript

195 // pkgs: { name: 'pkg-name' } 数组

196 const list = pkgs.map(p => p.name).join(' ');

197 switch (pkgMgr) {

198 case 'apt': return `apt-get update && apt-get install -y ${list}`;

199 case 'dnf':

200 case 'yum': return `${pkgMgr} install -y ${list}`;

201 case 'apk': return `apk add ${list}`;

202 case 'pacman': return `pacman -Sy --noconfirm ${list}`;

203 default: return null;

204 }

205}

206

207function buildSystemdUnit() {

208 // Audio8 onnx_runtime 需要 numpy 2.4.3(需 Python ≥ 3.11),Ubuntu 22.04 默认 3.10

209 // 自动探测 python3.11(PPA/官方包),fallback 到 python3

210 const pyBin = (function(){

211 try { execSync('command -v python3.11 2>/dev/null', { shell: '/bin/bash', stdio: 'pipe' }); return 'python3.11'; }

212 catch (e) { return 'python3'; }

213 })();

214 // systemd 不展开 ~，必须用绝对路径(root 下 $HOME=/root)

215 const home = (function(){

216 try { return execSync('/bin/bash -c "echo $HOME"', { shell: '/bin/bash', stdio: 'pipe', encoding: 'utf8' }).trim() || '/root'; }

217 catch (e) { return '/root'; }

High

Shell

Package source references shell execution.

tts/providers/audio8.jsView on unpkg · L215

218 })();

219 const deployDir = AUDIO8_DEPLOY_DIR.replace(/^~/, home);

220 const venvDir = AUDIO8_VENV_DIR.replace(/^~/, home);

221 return `[Unit]

222Description=Audio8 TTS (AdoreMix)

223After=network.target

224

225[Service]

226Type=simple

227User=root

228WorkingDirectory=${deployDir}/onnx_runtime

229Environment=PATH=${venvDir}/bin:/usr/bin:/bin

230ExecStart=${venvDir}/bin/${pyBin} -m arktts_runtime.service --model-dir ./model --voices-dir ./model/voices --port ${AUDIO8_DEFAULT_PORT}

231Restart=on-failure

232RestartSec=5

233

234[Install]

235WantedBy=multi-user.target

Lines 367-407javascript

367 // 写 systemd 单元

368 try {

369 fs.writeFileSync(AUDIO8_SYSTEMD_PATH, buildSystemdUnit(), 'utf8');

370 execSync('systemctl daemon-reload', { stdio: 'inherit', shell: '/bin/bash' });

371 execSync(`systemctl enable ${AUDIO8_SYSTEMD_NAME}`, { stdio: 'inherit', shell: '/bin/bash' });

372 execSync(`systemctl restart ${AUDIO8_SYSTEMD_NAME}`, { stdio: 'inherit', shell: '/bin/bash' });

373 } catch (e) {

374 logger.error('systemd 配置失败（无 systemd 容器？手动启动: ~/audio8_venv/bin/python -m arktts_runtime.service）: ' + e.message.slice(0, 200));

375 return 1;

376 }

377

378 // 等服务健康（含下载 572MB 模型，冷启动最多 60s）

379 logger.log('=== 等待服务健康（首次启动要下载 ~572MB 模型，最多 60 秒）===');

380 let ok = false;

381 for (let i = 1; i <= 30; i++) {

382 try {

383 execSync(`curl -sf ${AUDIO8_HEALTH_URL} >/dev/null 2>&1`);

384 logger.ok(`Audio8 服务在 ${i*2} 秒后就绪: ${AUDIO8_HEALTH_URL}`);

385 ok = true;

386 break;

387 } catch (e) {}

388 execSync('sleep 2', { stdio: 'pipe', shell: '/bin/bash' });

389 }

390 if (!ok) {

391 logger.warn('60 秒内未就绪，请手动 systemctl status ' + AUDIO8_SYSTEMD_NAME);

392 logger.log('也可直接前台启动测试: source ~/.audio8_venv/bin/activate && python -m arktts_runtime.service --model-dir ~/audio8/model --voices-dir ~/audio8/model/voices --port ' + AUDIO8_DEFAULT_PORT);

393 }

394

395 // 改本地 config.ini

396 try {

397 const cfg = require(path.join(__dirname, '..', 'src', 'config'));

398 const wd = opts.workdir || process.env.ADOREMIX_WORKDIR || path.join(os.homedir(), '.local', 'share', 'adoremix');

399 cfg.setConfigValue(wd, 'TTS.provider', 'audio8');

400 cfg.setConfigValue(wd, 'TTS.audio8_base_url', `http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

401 logger.ok(`config.ini 已更新: provider=audio8, audio8_base_url=http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

tts/providers/audio8.jsView on unpkg · L387

402 } catch (e) {

403 logger.warn('config.ini 更新失败: ' + e.message);

404 }

405

406 logger.ok(`Audio8 TTS 本机安装完成 → http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

407 return 0;

•Trigger-reachable chain: manifest.main -> src/index.js -> src/cli.js -> tts/providers/audio8.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

tts/providers/audio8.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @oxiaom/adoremix@1.0.43 matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.43 similarity = 0.978 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tts/providers/audio8.jsView on unpkg

bin/postinstall-hint.jsView file

Lines 1-15javascript

1'use strict';

3const logger = require('../src/logger');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

5logger.log('');

6logger.log(' AdoreMix CLI 已安装。');

7logger.log('');

8logger.log(' 下一步：');

9logger.log(' 1. 运行 adoremix install 初始化工作目录、复制资源并生成 config.ini');

10logger.log(' 2. 运行 adoremix start 启动服务（前台）');

11logger.log(' 3. 运行 adoremix service install 注册开机自启动');

12logger.log('');

13logger.log(' 帮助：adoremix --help');

14logger.log('');

config-manager/app.pyView file

•path = config-manager/app.py kind = build_helper sizeBytes = 22302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config-manager/app.pyView on unpkg

src/install.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/install.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/install.jsView on unpkg

src/tts-deps.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/tts-deps.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tts-deps.jsView on unpkg

src/config-manager.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/config-manager.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-manager.jsView on unpkg

src/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/doctor.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/doctor.jsView on unpkg

src/nginx.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/nginx.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/nginx.jsView on unpkg

src/paths.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/paths.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/paths.jsView on unpkg

src/tts-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/tts-cli.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tts-cli.jsView on unpkg

tts/providers/xf.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = tts/providers/xf.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tts/providers/xf.jsView on unpkg

tts/providers/minimax.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = tts/providers/minimax.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tts/providers/minimax.jsView on unpkg

webui/high/assets/api-C3Fyph-A.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = webui/high/assets/api-C3Fyph-A.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

webui/high/assets/api-C3Fyph-A.jsView on unpkg

webui/low/assets/api-C3Fyph-A.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

webui/low/assets/api-C3Fyph-A.jsView on unpkg

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall-hint.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

tts/providers/edge.jsView file

11L12: const { execFileSync } = require('child_process'); L13: const fs = require('fs');

High

Child Process

Package source references child process execution.

tts/providers/edge.jsView on unpkg · L11

tts/providers/audio8.jsView file

387} catch (e) {} L388: execSync('sleep 2', { stdio: 'pipe', shell: '/bin/bash' }); L389: } ... L397: const cfg = require(path.join(__dirname, '..', 'src', 'config')); L398: const wd = opts.workdir || process.env.ADOREMIX_WORKDIR || path.join(os.homedir(), '.local', 'share', 'adoremix'); L399: cfg.setConfigValue(wd, 'TTS.provider', 'audio8'); L400: cfg.setConfigValue(wd, 'TTS.audio8_base_url', `http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`); L401: logger.ok(`config.ini 已更新: provider=audio8, audio8_base_url=http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

tts/providers/audio8.jsView on unpkg · L387

•Trigger-reachable chain: manifest.main -> src/index.js -> src/cli.js -> tts/providers/audio8.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

tts/providers/audio8.jsView on unpkg

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tts/providers/audio8.jsView on unpkg

215const home = (function(){ L216: try { return execSync('/bin/bash -c "echo $HOME"', { shell: '/bin/bash', stdio: 'pipe', encoding: 'utf8' }).trim() || '/root'; } L217: catch (e) { return '/root'; }

High

Shell

Package source references shell execution.

tts/providers/audio8.jsView on unpkg · L215

8Trigger-reachable persistence chain: manifest.main -> src/index.js -> src/cli.js -> tts/providers/audio8.js L8: * 服务部署参考（Audio8-AI/Audio8_TTS）： L9: * git clone https://github.com/Audio8-AI/Audio8_TTS.git ~/audio8 L10: * cd ~/audio8/onnx_runtime && python3 -m venv .venv && . .venv/bin/activate ... L21: L22: const { execFileSync, execSync } = require('child_process'); L23: const fs = require('fs'); ... L155: }); L156: req.write(postData); L157: req.end(); ... L176: // 包管理器嗅探（apt/dnf/yum/apk/pacman） L177: // 用 which 而非 command -v（Debian/Ubuntu 12+ 的 /bin/sh 没有 command 内建，且 PATH 不一定对） L178: function detectPkgMgr() {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

tts/providers/audio8.jsView on unpkg · L8

8* 服务部署参考（Audio8-AI/Audio8_TTS）： L9: * git clone https://github.com/Audio8-AI/Audio8_TTS.git ~/audio8 L10: * cd ~/audio8/onnx_runtime && python3 -m venv .venv && . .venv/bin/activate ... L21: L22: const { execFileSync, execSync } = require('child_process'); L23: const fs = require('fs'); ... L155: }); L156: req.write(postData); L157: req.end(); ... L176: // 包管理器嗅探（apt/dnf/yum/apk/pacman） L177: // 用 which 而非 command -v（Debian/Ubuntu 12+ 的 /bin/sh 没有 command 内建，且 PATH 不一定对） L178: function detectPkgMgr() {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

tts/providers/audio8.jsView on unpkg · L8

bin/postinstall-hint.jsView file

2L3: const logger = require('../src/logger'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

config-manager/app.pyView file

•path = config-manager/app.py kind = build_helper sizeBytes = 22302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config-manager/app.pyView on unpkg

src/install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/install.jsView on unpkg

src/tts-deps.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tts-deps.jsView on unpkg

src/config-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-manager.jsView on unpkg

src/doctor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/doctor.jsView on unpkg

src/nginx.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/nginx.jsView on unpkg

src/paths.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/paths.jsView on unpkg

src/tts-cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tts-cli.jsView on unpkg

tts/providers/xf.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tts/providers/xf.jsView on unpkg

tts/providers/minimax.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tts/providers/minimax.jsView on unpkg

webui/high/assets/api-C3Fyph-A.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

webui/high/assets/api-C3Fyph-A.jsView on unpkg

webui/low/assets/api-C3Fyph-A.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

webui/low/assets/api-C3Fyph-A.jsView on unpkg

Findings

3 Critical16 High6 Medium5 Low

CriticalSame File Env Network Executiontts/providers/audio8.js

CriticalTrigger Reachable Dangerous Capabilitytts/providers/audio8.js

CriticalPrevious Version Dangerous Deltatts/providers/audio8.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processtts/providers/edge.js

HighShelltts/providers/audio8.js

HighTrigger Reachable Persistencetts/providers/audio8.js

HighSemantic Analysis Limitedpackage.json

HighKnown Malware Source Similaritysrc/install.js

HighKnown Malware Source Similaritysrc/tts-deps.js

HighKnown Malware Source Similaritysrc/config-manager.js

HighKnown Malware Source Similaritysrc/doctor.js

HighKnown Malware Source Similaritysrc/nginx.js

HighKnown Malware Source Similaritysrc/paths.js

HighKnown Malware Source Similaritysrc/tts-cli.js

HighKnown Malware Source Similaritytts/providers/xf.js

HighKnown Malware Source Similaritytts/providers/minimax.js

HighKnown Malware Source Similaritywebui/high/assets/api-C3Fyph-A.js

HighKnown Malware Source Similaritywebui/low/assets/api-C3Fyph-A.js

MediumDynamic Requirebin/postinstall-hint.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencetts/providers/audio8.js

MediumShips Build Helperconfig-manager/app.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings