@oxiaom/adoremix@1.0.55: Suspicious npm security report (Warn)

Loading npm security reports…

@oxiaom/adoremix@1.0.55: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

22 flagged

package.jsonView file

Lines 16-55json

16 "@oxiaom/adoremix-linux-arm64": "^1.0.0",

17 "@oxiaom/adoremix-linux-arm": "^1.0.0",

18 "@oxiaom/adoremix-darwin-arm64": "^1.0.0"

19 },

20 "dependencies": {

21 "commander": "^12.1.0",

22 "ini": "^4.1.3",

23 "pidusage": "^3.0.2",

24 "fs-extra": "^11.2.0",

25 "prompts": "^2.4.2"

26 },

27 "peerDependencies": {

28 "node-windows": "^1.0.0-beta.8"

29 },

30 "peerDependenciesMeta": {

31 "node-windows": {

32 "optional": true

33 }

34 },

35 "scripts": {

36 "postinstall": "node ./bin/postinstall-hint.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 },

38 "files": [

39 "bin",

40 "src",

41 "templates",

42 "tts",

43 "webui",

44 "config-manager"

45 ],

46 "keywords": [

47 "adoremix",

48 "broadcast",

49 "server",

50 "qt",

51 "installer"

52 ],

53 "license": "MIT"

54}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

tts/providers/edge.jsView file

Lines 1-31javascript

1'use strict';

3/**

4 * Edge TTS provider（免费）

5 * 调用方式：python edge-tts 包 + ffmpeg 转 mp3

6 * 凭证：不需要（免费）

7 *

8 * 依赖：python3 + pip install edge-tts + ffmpeg

9 * 自动检测：adoremix tts deps

10 */

12const

tts/providers/audio8.jsView file

Lines 1-28javascript

1'use strict';

3/**

4 * Audio8 TTS provider

5 * 调用方式：HTTP 调用本地 Audio8 TTS 服务（OpenAI 兼容 /v1/audio/speech）

6 * 支持流式 MP3 输出（设备边收边播，匹配现有 quemp3 推送管道）

7 *

8 * 服务部署参考（Audio8-AI/Audio8_TTS）：

9 * git clone https://github.com/Audio8-AI/Audio8_TTS.git ~/audio8

10 * cd ~/audio8/onnx_runtime && python3 -m venv .venv && . .venv/bin/activate

11 * pip install -r requirements.txt # torch/transformers/onnxruntime 等

bin/postinstall-hint.jsView file

Lines 1-15javascript

1'use strict';

3const logger = require('../src/logger');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

5logger.log('');

config-manager/app.pyView file

•path = config-manager/app.py kind = build_helper sizeBytes = 22302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config-manager/app.pyView on unpkg

src/install.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/install.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/install.jsView on unpkg

src/tts-deps.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/tts-deps.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tts-deps.jsView on unpkg

src/config-manager.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/config-manager.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-manager.jsView on unpkg

src/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/doctor.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/doctor.jsView on unpkg

src/nginx.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/nginx.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/nginx.jsView on unpkg

src/paths.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/paths.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/paths.jsView on unpkg

src/tts-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/tts-cli.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tts-cli.jsView on unpkg

tts/providers/xf.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = tts/providers/xf.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tts/providers/xf.jsView on unpkg

tts/providers/minimax.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = tts/providers/minimax.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tts/providers/minimax.jsView on unpkg

webui/high/assets/api-C3Fyph-A.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = webui/high/assets/api-C3Fyph-A.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

webui/high/assets/api-C3Fyph-A.jsView on unpkg

webui/low/assets/api-C3Fyph-A.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

webui/low/assets/api-C3Fyph-A.jsView on unpkg

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall-hint.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

tts/providers/edge.jsView file

11L12: const { execFileSync } = require('child_process'); L13: const fs = require('fs');

High

Child Process

Package source references child process execution.

tts/providers/edge.jsView on unpkg · L11

tts/providers/audio8.jsView file

387} catch (e) {} L388: execSync('sleep 2', { stdio: 'pipe', shell: '/bin/bash' }); L389: } ... L397: const cfg = require(path.join(__dirname, '..', 'src', 'config')); L398: const wd = opts.workdir || process.env.ADOREMIX_WORKDIR || path.join(os.homedir(), '.local', 'share', 'adoremix'); L399: cfg.setConfigValue(wd, 'TTS.provider', 'audio8'); L400: cfg.setConfigValue(wd, 'TTS.audio8_base_url', `http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`); L401: logger.ok(`config.ini 已更新: provider=audio8, audio8_base_url=http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

tts/providers/audio8.jsView on unpkg · L387

•Trigger-reachable chain: manifest.main -> src/index.js -> src/cli.js -> tts/providers/audio8.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

tts/providers/audio8.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @oxiaom/adoremix@1.0.43 matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.43 similarity = 0.978 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tts/providers/audio8.jsView on unpkg

bin/postinstall-hint.jsView file

2L3: const logger = require('../src/logger'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

config-manager/app.pyView file

•path = config-manager/app.py kind = build_helper sizeBytes = 22302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config-manager/app.pyView on unpkg

src/install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/install.jsView on unpkg

src/tts-deps.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tts-deps.jsView on unpkg

src/config-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-manager.jsView on unpkg

src/doctor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/doctor.jsView on unpkg

src/nginx.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/nginx.jsView on unpkg

src/paths.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/paths.jsView on unpkg

src/tts-cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tts-cli.jsView on unpkg

tts/providers/xf.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tts/providers/xf.jsView on unpkg

tts/providers/minimax.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tts/providers/minimax.jsView on unpkg

webui/high/assets/api-C3Fyph-A.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

webui/high/assets/api-C3Fyph-A.jsView on unpkg

webui/low/assets/api-C3Fyph-A.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

webui/low/assets/api-C3Fyph-A.jsView on unpkg

Source & flagged code

22 flagged

package.jsonView file

Lines 16-55json

16 "@oxiaom/adoremix-linux-arm64": "^1.0.0",

17 "@oxiaom/adoremix-linux-arm": "^1.0.0",

18 "@oxiaom/adoremix-darwin-arm64": "^1.0.0"

19 },

20 "dependencies": {

21 "commander": "^12.1.0",

22 "ini": "^4.1.3",

23 "pidusage": "^3.0.2",

24 "fs-extra": "^11.2.0",

25 "prompts": "^2.4.2"

26 },

27 "peerDependencies": {

28 "node-windows": "^1.0.0-beta.8"

29 },

30 "peerDependenciesMeta": {

31 "node-windows": {

32 "optional": true

33 }

34 },

35 "scripts": {

36 "postinstall": "node ./bin/postinstall-hint.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 },

38 "files": [

39 "bin",

40 "src",

41 "templates",

42 "tts",

43 "webui",

44 "config-manager"

45 ],

46 "keywords": [

47 "adoremix",

48 "broadcast",

49 "server",

50 "qt",

51 "installer"

52 ],

53 "license": "MIT"

54}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

tts/providers/edge.jsView file

Lines 1-31javascript

1'use strict';

3/**

4 * Edge TTS provider（免费）

5 * 调用方式：python edge-tts 包 + ffmpeg 转 mp3

6 * 凭证：不需要（免费）

7 *

8 * 依赖：python3 + pip install edge-tts + ffmpeg

9 * 自动检测：adoremix tts deps

10 */

12const

tts/providers/audio8.jsView file

Lines 1-28javascript

1'use strict';

3/**

4 * Audio8 TTS provider

5 * 调用方式：HTTP 调用本地 Audio8 TTS 服务（OpenAI 兼容 /v1/audio/speech）

6 * 支持流式 MP3 输出（设备边收边播，匹配现有 quemp3 推送管道）

7 *

8 * 服务部署参考（Audio8-AI/Audio8_TTS）：

9 * git clone https://github.com/Audio8-AI/Audio8_TTS.git ~/audio8

10 * cd ~/audio8/onnx_runtime && python3 -m venv .venv && . .venv/bin/activate

11 * pip install -r requirements.txt # torch/transformers/onnxruntime 等

bin/postinstall-hint.jsView file

Lines 1-15javascript

1'use strict';

3const logger = require('../src/logger');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

5logger.log('');

config-manager/app.pyView file

•path = config-manager/app.py kind = build_helper sizeBytes = 22302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config-manager/app.pyView on unpkg

src/install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/install.jsView on unpkg

src/tts-deps.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tts-deps.jsView on unpkg

src/config-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-manager.jsView on unpkg

src/doctor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/doctor.jsView on unpkg

src/nginx.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/nginx.jsView on unpkg

src/paths.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/paths.jsView on unpkg

src/tts-cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tts-cli.jsView on unpkg

tts/providers/xf.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tts/providers/xf.jsView on unpkg

tts/providers/minimax.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tts/providers/minimax.jsView on unpkg

webui/high/assets/api-C3Fyph-A.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

webui/high/assets/api-C3Fyph-A.jsView on unpkg

webui/low/assets/api-C3Fyph-A.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

webui/low/assets/api-C3Fyph-A.jsView on unpkg

Lines 367-407javascript

367 // 写 systemd 单元

368 try {

369 fs.writeFileSync(AUDIO8_SYSTEMD_PATH, buildSystemdUnit(), 'utf8');

370 execSync('systemctl daemon-reload', { stdio: 'inherit', shell: '/bin/bash' });

371 execSync(`systemctl enable ${AUDIO8_SYSTEMD_NAME}`, { stdio: 'inherit', shell: '/bin/bash' });

372 execSync(`systemctl restart ${AUDIO8_SYSTEMD_NAME}`, { stdio: 'inherit', shell: '/bin/bash' });

373 } catch (e) {

374 logger.error('systemd 配置失败（无 systemd 容器？手动启动: ~/audio8_venv/bin/python -m arktts_runtime.service）: ' + e.message.slice(0, 200));

375 return 1;

376 }

377

378 // 等服务健康（含下载 572MB 模型，冷启动最多 60s）

379 logger.log('=== 等待服务健康（首次启动要下载 ~572MB 模型，最多 60 秒）===');

380 let ok = false;

381 for (let i = 1; i <= 30; i++) {

382 try {

383 execSync(`curl -sf ${AUDIO8_HEALTH_URL} >/dev/null 2>&1`);

384 logger.ok(`Audio8 服务在 ${i*2} 秒后就绪: ${AUDIO8_HEALTH_URL}`);

385 ok = true;

386 break;

387 } catch (e) {}

388 execSync('sleep 2', { stdio: 'pipe', shell: '/bin/bash' });

389 }

390 if (!ok) {

391 logger.warn('60 秒内未就绪，请手动 systemctl status ' + AUDIO8_SYSTEMD_NAME);

392 logger.log('也可直接前台启动测试: source ~/.audio8_venv/bin/activate && python -m arktts_runtime.service --model-dir ~/audio8/model --voices-dir ~/audio8/model/voices --port ' + AUDIO8_DEFAULT_PORT);

393 }

394

395 // 改本地 config.ini

396 try {

397 const cfg = require(path.join(__dirname, '..', 'src', 'config'));

398 const wd = opts.workdir || process.env.ADOREMIX_WORKDIR || path.join(os.homedir(), '.local', 'share', 'adoremix');

399 cfg.setConfigValue(wd, 'TTS.provider', 'audio8');

400 cfg.setConfigValue(wd, 'TTS.audio8_base_url', `http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

401 logger.ok(`config.ini 已更新: provider=audio8, audio8_base_url=http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

tts/providers/audio8.jsView on unpkg · L387

402 } catch (e) {

403 logger.warn('config.ini 更新失败: ' + e.message);

404 }

405

406 logger.ok(`Audio8 TTS 本机安装完成 → http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);

407 return 0;

@oxiaom/adoremix@1.0.55

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code