@oxiaom/adoremix@1.0.43: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@oxiaom/adoremix@1.0.43: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall-hint.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

tts/providers/edge.jsView file

11L12: const { execFileSync } = require('child_process'); L13: const fs = require('fs');

High

Child Process

Package source references child process execution.

tts/providers/edge.jsView on unpkg · L11

bin/postinstall-hint.jsView file

2L3: const logger = require('../src/logger'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

tts/providers/audio8.jsView file

321} catch (e) {} L322: execSync('sleep 2', { stdio: 'pipe', shell: '/bin/bash' }); L323: } ... L331: const cfg = require(path.join(__dirname, '..', 'src', 'config')); L332: const wd = opts.workdir || process.env.ADOREMIX_WORKDIR || path.join(os.homedir(), '.local', 'share', 'adoremix'); L333: cfg.setConfigValue(wd, 'TTS.provider', 'audio8'); L334: cfg.setConfigValue(wd, 'TTS.audio8_base_url', `http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`); L335: logger.ok(`config.ini 已更新: provider=audio8, audio8_base_url=http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

tts/providers/audio8.jsView on unpkg · L321

•Trigger-reachable chain: manifest.main -> src/index.js -> src/cli.js -> tts/providers/audio8.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

tts/providers/audio8.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @oxiaom/adoremix@1.0.40 matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.40 similarity = 0.943 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

config-manager/app.pyView file

•path = config-manager/app.py kind = build_helper sizeBytes = 22302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config-manager/app.pyView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 16-55json

16 "@oxiaom/adoremix-linux-arm64": "^1.0.0",

17 "@oxiaom/adoremix-linux-arm": "^1.0.0",

18 "@oxiaom/adoremix-darwin-arm64": "^1.0.0"

19 },

20 "dependencies": {

21 "commander": "^12.1.0",

22 "ini": "^4.1.3",

23 "pidusage": "^3.0.2",

24 "fs-extra": "^11.2.0",

25 "prompts": "^2.4.2"

26 },

27 "peerDependencies": {

28 "node-windows": "^1.0.0-beta.8"

29 },

30 "peerDependenciesMeta": {

31 "node-windows": {

32 "optional": true

33 }

34 },

35 "scripts": {

36 "postinstall": "node ./bin/postinstall-hint.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 },

38 "files": [

39 "bin",

40 "src",

41 "templates",

42 "tts",

43 "webui",

44 "config-manager"

45 ],

46 "keywords": [

47 "adoremix",

48 "broadcast",

49 "server",

50 "qt",

51 "installer"

52 ],

53 "license": "MIT"

54}

55

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

tts/providers/edge.jsView file

Lines 1-31javascript

1'use strict';

2

3/**

4 * Edge TTS provider（免费）

5 * 调用方式：python edge-tts 包 + ffmpeg 转 mp3

6 * 凭证：不需要（免费）

7 *

8 * 依赖：python3 + pip install edge-tts + ffmpeg

9 * 自动检测：adoremix tts deps

10 */

11

12const

bin/postinstall-hint.jsView file

Lines 1-15javascript

1'use strict';

2

3const logger = require('../src/logger');

4

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

5logger.log('');

tts/providers/audio8.jsView file

Lines 1-28javascript

1'use strict';

2

3/**

4 * Audio8 TTS provider

5 * 调用方式：HTTP 调用本地 Audio8 TTS 服务（OpenAI 兼容 /v1/audio/speech）

6 * 支持流式 MP3 输出（设备边收边播，匹配现有 quemp3 推送管道）

7 *

8 * 服务部署参考（Audio8-AI/Audio8_TTS）：

9 * git clone https://github.com/Audio8-AI/Audio8_TTS.git ~/audio8

10 * cd ~/audio8/onnx_runtime && python3 -m venv .venv && . .venv/bin/activate

11 * pip install -r requirements.txt # torch/transformers/onnxruntime 等

config-manager/app.pyView file

•path = config-manager/app.py kind = build_helper sizeBytes = 22302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config-manager/app.pyView on unpkg

Lines 301-341javascript

301 // 写 systemd 单元

302 try {

303 fs.writeFileSync(AUDIO8_SYSTEMD_PATH, buildSystemdUnit(), 'utf8');

304 execSync('systemctl daemon-reload', { stdio: 'inherit', shell: '/bin/bash' });

305 execSync(`systemctl enable ${AUDIO8_SYSTEMD_NAME}`, { stdio: 'inherit', shell: '/bin/bash' });

306 execSync(`systemctl restart ${AUDIO8_SYSTEMD_NAME}`, { stdio: 'inherit', shell: '/bin/bash' });

307 } catch (e) {

308 logger.error('systemd 配置失败（无 systemd 容器？手动启动: ~/audio8_venv/bin/python -m arktts_runtime.service）: ' + e.message.slice(0, 200));

309 return 1;

310 }

311

312 // 等服务健康（含下载 572MB 模型，冷启动最多 60s）

313 logger.log('=== 等待服务健康（首次启动要下载 ~572MB 模型，最多 60 秒）===');

314 let ok = false;

315 for (let i = 1; i <= 30; i++) {

316 try {

317 execSync(`curl -sf ${AUDIO8_HEALTH_URL} >/dev/null 2>&1`);

318 logger.ok(`Audio8 服务在 ${i*2} 秒后就绪: ${AUDIO8_HEALTH_URL}`);

319 ok = true;

320 break;

321 } catch (e) {}

322 execSync('sleep 2', { stdio: 'pipe', shell: '/bin/bash' });

323 }

324 if (!ok) {

325 logger.warn('60 秒内未就绪，请手动 systemctl status ' + AUDIO8_SYSTEMD_NAME);

326 logger.log('也可直接前台启动测试: source ~/.audio8_venv/bin/activate && python -m arktts_runtime.service --model-dir ~/audio8/model --voices-dir ~/audio8/model/voices --port ' + AUDIO8_DEFAULT_PORT);

327 }

328

329 // 改本地 config.ini

330 try {

331 const cfg = require(path.join(__dirname, '..', 'src', 'config'));

332 const wd = opts.workdir || process.env.ADOREMIX_WORKDIR || path.join(os.homedir(), '.local', 'share', 'adoremix');

333 cfg.setConfigValue(wd, 'TTS.provider', 'audio8');

334 cfg.setConfigValue(wd, 'TTS.audio8_base_url', `http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

335 logger.ok(`config.ini 已更新: provider=audio8, audio8_base_url=http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

tts/providers/audio8.jsView on unpkg · L321

336 } catch (e) {

337 logger.warn('config.ini 更新失败: ' + e.message);

338 }

339

340 logger.ok(`Audio8 TTS 本机安装完成 → http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

341 return 0;