@oxiaom/adoremix@1.0.38: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@oxiaom/adoremix@1.0.38: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall-hint.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

tts/providers/edge.jsView file

11L12: const { execFileSync } = require('child_process'); L13: const fs = require('fs');

High

Child Process

Package source references child process execution.

tts/providers/edge.jsView on unpkg · L11

src/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @oxiaom/adoremix@1.0.34 matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.34 similarity = 0.965 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.jsView on unpkg

372if (process.platform === 'win32') { L373: logger.warn('Windows 不支持 -f，请用 PowerShell 自行 Get-Content -Wait'); L374: const tail = spawn('more', [file], { stdio: 'inherit' });

High

Shell

Package source references shell execution.

src/cli.jsView on unpkg · L372

webui/high/assets/index-npdYRXyk.jsView file

17* Released under the MIT License. L18: */function da(e){return oe(e)&&0===ha(e)&&(te(e,"b")||te(e,"body"))}const ca=["b","body"];const ua=["c","cases"];const ma=["s","static"];const pa=["i","items"];const ga=["t","type"...

Low

Eval

Package source references a known benign dynamic code generation pattern.

webui/high/assets/index-npdYRXyk.jsView on unpkg · L17

bin/postinstall-hint.jsView file

2L3: const logger = require('../src/logger'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

src/config-manager.jsView file

4Trigger-reachable persistence chain: manifest.main -> src/index.js -> src/cli.js -> src/config-manager.js L4: const path = require('path'); L5: const { execSync } = require('child_process'); L6: const logger = require('./logger'); ... L23: function copyCode(workdir) { L24: const srcDir = path.join(__dirname, '..', 'config-manager'); L25: const dstDir = path.join(workdir, 'config-manager'); ... L53: function install(workdir) { L54: if (process.platform !== 'linux') { L55: logger.error('config-manager 仅支持 Linux（依赖 systemd）'); ... L102: execSync('systemctl daemon-reload', { stdio: 'inherit' }); L103: execSync(`systemctl enable ${SERVICE_NAME}`, { stdio: 'inherit' }); L104: execSync(`systemctl restart ${SERVICE_NAME}`, { stdio: 'inherit' });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/config-manager.jsView on unpkg · L4

4const path = require('path'); L5: const { execSync } = require('child_process'); L6: const logger = require('./logger'); ... L23: function copyCode(workdir) { L24: const srcDir = path.join(__dirname, '..', 'config-manager'); L25: const dstDir = path.join(workdir, 'config-manager'); ... L53: function install(workdir) { L54: if (process.platform !== 'linux') { L55: logger.error('config-manager 仅支持 Linux（依赖 systemd）'); ... L102: execSync('systemctl daemon-reload', { stdio: 'inherit' }); L103: execSync(`systemctl enable ${SERVICE_NAME}`, { stdio: 'inherit' }); L104: execSync(`systemctl restart ${SERVICE_NAME}`, { stdio: 'inherit' });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/config-manager.jsView on unpkg · L4

src/doctor.jsView file

2L3: const { execSync } = require('child_process'); L4: const fs = require('fs'); ... L35: // node arch → [deb arch, Ubuntu 源根] L36: arm64: ['arm64', 'http://ports.ubuntu.com/ubuntu-ports'], // 非 amd64 架构走 ports L37: arm: ['armhf', 'http://ports.ubuntu.com/ubuntu-ports'], // armv7 / armhf（树莓派 32 位、老款盒子） ... L41: function getIcu70DebInfo() { L42: const src = ICU70_DEB_SOURCES[process.arch]; L43: if (!src) return null; ... L169: if (e && e.code === 'NATIVE_VERSION_MISMATCH') { L170: const mainVer = e.mainVersion || require('../package.json').version; L171: const fixCmd = `npm install -g @oxiaom/adoremix@${mainVer} --registry https://registry.npmjs.org`;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/doctor.jsView on unpkg · L2

src/install.jsView file

105try { L106: execSync('npm install --production --no-audit --no-fund', { L107: cwd: workdir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/install.jsView on unpkg · L105

config-manager/app.pyView file

•path = config-manager/app.py kind = build_helper sizeBytes = 22302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config-manager/app.pyView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 16-55json

16 "@oxiaom/adoremix-linux-arm64": "^1.0.0",

17 "@oxiaom/adoremix-linux-arm": "^1.0.0",

18 "@oxiaom/adoremix-darwin-arm64": "^1.0.0"

19 },

20 "dependencies": {

21 "commander": "^12.1.0",

22 "ini": "^4.1.3",

23 "pidusage": "^3.0.2",

24 "fs-extra": "^11.2.0",

25 "prompts": "^2.4.2"

26 },

27 "peerDependencies": {

28 "node-windows": "^1.0.0-beta.8"

29 },

30 "peerDependenciesMeta": {

31 "node-windows": {

32 "optional": true

33 }

34 },

35 "scripts": {

36 "postinstall": "node ./bin/postinstall-hint.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 },

38 "files": [

39 "bin",

40 "src",

41 "templates",

42 "tts",

43 "webui",

44 "config-manager"

45 ],

46 "keywords": [

47 "adoremix",

48 "broadcast",

49 "server",

50 "qt",

51 "installer"

52 ],

53 "license": "MIT"

54}

55

tts/providers/edge.jsView file

Lines 1-31javascript

1'use strict';

2

3/**

4 * Edge TTS provider（免费）

5 * 调用方式：python edge-tts 包 + ffmpeg 转 mp3

6 * 凭证：不需要（免费）

7 *

8 * 依赖：python3 + pip install edge-tts + ffmpeg

9 * 自动检测：adoremix tts deps

10 */

11

12const

src/cli.jsView file

Lines 352-392javascript

352 try {

353 const m = fs.statSync(f).mtimeMs;

354 if (m > bestMtime) { bestMtime = m; file = f; }

355 } catch (e) {}

webui/high/assets/index-npdYRXyk.jsView file

17* Released under the MIT License. L18: */function da(e){return oe(e)&&0===ha(e)&&(te(e,"b")||te(e,"body"))}const ca=["b","body"];const ua=["c","cases"];const ma=["s","static"];const pa=["i","items"];const ga=["t","type"...

Low

Eval

Package source references a known benign dynamic code generation pattern.

webui/high/assets/index-npdYRXyk.jsView on unpkg · L17

bin/postinstall-hint.jsView file

Lines 1-15javascript

1'use strict';

2

3const logger = require('../src/logger');

4

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

5logger.log('');

src/config-manager.jsView file

Lines 1-24javascript

1'use strict';

2

3const fs = require('fs');

4const path = require('path');

5const {

src/doctor.jsView file

Lines 1-22javascript

1'use strict';

2

3const { execSync } = require('child_process');

4const fs = require('fs');

High

Sandbox Evasion Gated Capability

src/install.jsView file

105try { L106: execSync('npm install --production --no-audit --no-fund', { L107: cwd: workdir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/install.jsView on unpkg · L105

config-manager/app.pyView file

•path = config-manager/app.py kind = build_helper sizeBytes = 22302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config-manager/app.pyView on unpkg