registry / AI-agent capability abuse / @oxiaom/adoremix / 1.0.56

@oxiaom/adoremix@1.0.56

AdoreMix broadcast server - cross-platform installer, runner and service manager

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package does not perform this behavior automatically at npm install, but its explicit management command creates an unauthenticated external control surface for a separate AI-agent configuration. This is a concrete dangerous capability requiring a warning.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The user runs adoremix config-manager install, then a network client accesses port 9877.

Impact

A reachable client can obtain API keys or redirect an agent to attacker-controlled model endpoints.

Mechanism

Unauthenticated web API reads and rewrites OpenClaw agent settings.

AI rationale

Evidence

config-manager/app.pysrc/config-manager.js/root/.openclaw/openclaw.json/etc/systemd/system/config-manager.service

Network endpoints1

[::]:9877

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Unknown with low false-positive risk.

Evidence for warning

The optional config-manager starts an unauthenticated Flask service on all IPv6 interfaces.
That service reads the root OpenClaw configuration and returns configured API keys to callers.
Its model endpoint accepts caller-supplied API keys and base URLs, then overwrites the OpenClaw agent configuration.
The CLI exposes config-manager installation, which registers and enables a persistent system service.

Evidence against

The npm postinstall hook only prints usage instructions; it does not invoke the installer or modify files.
The risky configuration manager is activated only by the explicit adoremix config-manager install command, not during package installation.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

25 flagged

package.jsonView file

Lines 16-56json

16 "@oxiaom/adoremix-linux-arm64": "^1.0.0",

17 "@oxiaom/adoremix-linux-arm": "^1.0.0",

18 "@oxiaom/adoremix-darwin-arm64": "^1.0.0"

19 },

20 "dependencies": {

21 "commander": "^12.1.0",

22 "ini": "^4.1.3",

23 "pidusage": "^3.0.2",

24 "fs-extra": "^11.2.0",

25 "prompts": "^2.4.2"

26 },

27 "peerDependencies": {

28 "node-windows": "^1.0.0-beta.8"

29 },

30 "peerDependenciesMeta": {

31 "node-windows": {

32 "optional": true

33 }

34 },

35 "scripts": {

36 "postinstall": "node ./bin/postinstall-hint.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 },

38 "files": [

39 "bin",

40 "src",

41 "templates",

42 "tts",

43 "webui",

44 "config-manager",

45 "audio8-assets"

46 ],

47 "keywords": [

48 "adoremix",

49 "broadcast",

50 "server",

51 "qt",

52 "installer"

53 ],

54 "license": "MIT"

55}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

tts/providers/edge.jsView file

Lines 1-31javascript

1'use strict';

3/**

4 * Edge TTS provider（免费）

5 * 调用方式：python edge-tts 包 + ffmpeg 转 mp3

6 * 凭证：不需要（免费）

7 *

8 * 依赖：python3 + pip install edge-tts + ffmpeg

9 * 自动检测：adoremix tts deps

10 */

12const

tts/providers/audio8.jsView file

Lines 1-28javascript

1'use strict';

3/**

4 * Audio8 TTS provider

5 * 调用方式：HTTP 调用本地 Audio8 TTS 服务（OpenAI 兼容 /v1/audio/speech）

6 * 支持流式 MP3 输出（设备边收边播，匹配现有 quemp3 推送管道）

7 *

8 * 服务部署参考（Audio8-AI/Audio8_TTS）：

9 * git clone https://github.com/Audio8-AI/Audio8_TTS.git ~/audio8

10 * cd ~/audio8/onnx_runtime && python3 -m venv .venv && . .venv/bin/activate

11 * pip install -r requirements.txt # torch/transformers/onnxruntime 等

bin/postinstall-hint.jsView file

Lines 1-15javascript

1'use strict';

3const logger = require('../src/logger');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-hint.jsView on unpkg · L2

5logger.log('');

config-manager/app.pyView file

•path = config-manager/app.py kind = build_helper sizeBytes = 22302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config-manager/app.pyView on unpkg

audio8-assets/audio8-tts.tgzView file

•path = audio8-assets/audio8-tts.tgz kind = high_entropy_blob sizeBytes = 27500544 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

audio8-assets/audio8-tts.tgzView on unpkg

•path = audio8-assets/audio8-tts.tgz kind = compressed_blob sizeBytes = 27500544 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

audio8-assets/audio8-tts.tgzView on unpkg

•path = audio8-assets/audio8-tts.tgz kind = nested_archive_needs_inspection sizeBytes = 27500544 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

audio8-assets/audio8-tts.tgzView on unpkg

src/install.jsView file

•matchType = normalized_sha256 matchedPackage = @oxiaom/adoremix@1.0.41 matchedPath = src/install.js matchedIdentity = npm:QG94aWFvbS9hZG9yZW1peA:1.0.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High