@oxiaom/adoremix@1.0.28: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@oxiaom/adoremix@1.0.28: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall-hint.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

tts/providers/edge.jsView file

11L12: const { execFileSync } = require('child_process'); L13: const fs = require('fs');

High

Child Process

Package source references child process execution.

tts/providers/edge.jsView on unpkg · L11

src/cli.jsView file

372if (process.platform === 'win32') { L373: logger.warn('Windows 不支持 -f，请用 PowerShell 自行 Get-Content -Wait'); L374: const tail = spawn('more', [file], { stdio: 'inherit' });

High

Shell

Package source references shell execution.

src/cli.jsView on unpkg · L372

webui/high/assets/index-npdYRXyk.jsView file

17* Released under the MIT License. L18: */function da(e){return oe(e)&&0===ha(e)&&(te(e,"b")||te(e,"body"))}const ca=["b","body"];const ua=["c","cases"];const ma=["s","static"];const pa=["i","items"];const ga=["t","type"...

Low

Eval

Package source references a known benign dynamic code generation pattern.

webui/high/assets/index-npdYRXyk.jsView on unpkg · L17

bin/postinstall-hint.jsView file

2L3: const logger = require('../src/logger'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

src/service/linux.jsView file

5Trigger-reachable persistence chain: manifest.main -> src/index.js -> src/cli.js -> src/service/index.js -> src/service/linux.js L5: const path = require('path'); L6: const { execSync } = require('child_process'); L7: const os = require('os'); ... L12: const SYSTEM_UNIT_PATH = '/etc/systemd/system/adoremix.service'; L13: const USER_UNIT_DIR = path.join(os.homedir(), '.config', 'systemd', 'user'); L14: const USER_UNIT_PATH = path.join(USER_UNIT_DIR, 'adoremix.service'); ... L64: execSync('systemctl daemon-reload'); L65: execSync('systemctl enable adoremix'); L66: logger.ok('systemctl enable adoremix');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/service/linux.jsView on unpkg · L5

5const path = require('path'); L6: const { execSync } = require('child_process'); L7: const os = require('os'); ... L12: const SYSTEM_UNIT_PATH = '/etc/systemd/system/adoremix.service'; L13: const USER_UNIT_DIR = path.join(os.homedir(), '.config', 'systemd', 'user'); L14: const USER_UNIT_PATH = path.join(USER_UNIT_DIR, 'adoremix.service'); ... L64: execSync('systemctl daemon-reload'); L65: execSync('systemctl enable adoremix'); L66: logger.ok('systemctl enable adoremix');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service/linux.jsView on unpkg · L5

src/doctor.jsView file

2L3: const { execSync } = require('child_process'); L4: const fs = require('fs'); ... L35: // node arch → [deb arch, Ubuntu 源根] L36: arm64: ['arm64', 'http://ports.ubuntu.com/ubuntu-ports'], // 非 amd64 架构走 ports L37: arm: ['armhf', 'http://ports.ubuntu.com/ubuntu-ports'], // armv7 / armhf（树莓派 32 位、老款盒子） ... L41: function getIcu70DebInfo() { L42: const src = ICU70_DEB_SOURCES[process.arch]; L43: if (!src) return null; ... L353: try { L354: const marker = JSON.parse(fs.readFileSync(markerPath, 'utf8')); L355: const pkgVer = require('../package.json').version;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/doctor.jsView on unpkg · L2

src/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @oxiaom/adoremix@1.0.22 matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.22 similarity = 0.965 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/install.jsView on unpkg

105try { L106: execSync('npm install --production --no-audit --no-fund', { L107: cwd: workdir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/install.jsView on unpkg · L105

Source & flagged code

10 flagged

package.jsonView file

Lines 16-54json

16 "@oxiaom/adoremix-linux-arm64": "^1.0.0",

17 "@oxiaom/adoremix-linux-arm": "^1.0.0",

18 "@oxiaom/adoremix-darwin-arm64": "^1.0.0"

19 },

20 "dependencies": {

21 "commander": "^12.1.0",

22 "ini": "^4.1.3",

23 "pidusage": "^3.0.2",

24 "fs-extra": "^11.2.0",

25 "prompts": "^2.4.2"

26 },

27 "peerDependencies": {

28 "node-windows": "^1.0.0-beta.8"

29 },

30 "peerDependenciesMeta": {

31 "node-windows": {

32 "optional": true

33 }

34 },

35 "scripts": {

36 "postinstall": "node ./bin/postinstall-hint.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 },

38 "files": [

39 "bin",

40 "src",

41 "templates",

42 "tts",

43 "webui"

44 ],

45 "keywords": [

46 "adoremix",

47 "broadcast",

48 "server",

49 "qt",

50 "installer"

51 ],

52 "license": "MIT"

53}

54

tts/providers/edge.jsView file

Lines 1-31javascript

1'use strict';

2

3/**

4 * Edge TTS provider（免费）

5 * 调用方式：python edge-tts 包 + ffmpeg 转 mp3

6 * 凭证：不需要（免费）

7 *

8 * 依赖：python3 + pip install edge-tts + ffmpeg

9 * 自动检测：adoremix tts deps

10 */

11

12const

src/cli.jsView file

Lines 352-392javascript

352 try {

353 const m = fs.statSync(f).mtimeMs;

354 if (m > bestMtime) { bestMtime = m; file = f; }

355 } catch (e) {}

webui/high/assets/index-npdYRXyk.jsView file

17* Released under the MIT License. L18: */function da(e){return oe(e)&&0===ha(e)&&(te(e,"b")||te(e,"body"))}const ca=["b","body"];const ua=["c","cases"];const ma=["s","static"];const pa=["i","items"];const ga=["t","type"...

Low

Eval

Package source references a known benign dynamic code generation pattern.

webui/high/assets/index-npdYRXyk.jsView on unpkg · L17

bin/postinstall-hint.jsView file

Lines 1-15javascript

1'use strict';

2

3const logger = require('../src/logger');

4

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

5logger.log('');

src/service/linux.jsView file

Lines 1-25javascript

1'use strict';

2

3const fs = require('fs');

4const fse = require('fs-extra');

5const

src/doctor.jsView file

Lines 1-22javascript

1'use strict';

2

3const { execSync } = require('child_process');

4const fs = require('fs');

High

Sandbox Evasion Gated Capability

src/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @oxiaom/adoremix@1.0.22 matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.22 similarity = 0.965 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/install.jsView on unpkg

105try { L106: execSync('npm install --production --no-audit --no-fund', { L107: cwd: workdir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/install.jsView on unpkg · L105