registry / @oxiaom/adoremix / 1.0.60
@oxiaom/adoremix@1.0.60
⚠ Under reviewAdoreMix broadcast server - cross-platform installer, runner and service manager
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe inspected lifecycle path only prints setup guidance, and dependency installation is part of an explicit CLI command. Manual review is needed because the required bundled archive was unreadable, so its contents could not be assessed.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall hint; work-directory initialization requires the explicit install command.
Impact
No harmful effect was established in the inspected source, but the unreadable archive prevents a complete assessment.
Mechanism
The postinstall script prints setup instructions. The explicit installer runs npm install in the selected work directory.
AI rationale
The inspected lifecycle path only prints setup guidance, and dependency installation is part of an explicit CLI command. Manual review is needed because the required bundled archive was unreadable, so its contents could not be assessed.
Evidence
audio8-assets/audio8-tts.tgzpackage.jsonbin/postinstall-hint.jssrc/cli.jssrc/install.js
Decision evidence
public snapshotAI called this Manual Review at 68.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package postinstall hook invokes a script that prints setup guidance.
- The CLI exposes initialization as an explicit install command.
- The installer runs npm install within the selected work directory.
- The required audio8-tts.tgz archive was unreadable to the source inspector, so its contents remain unresolved.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
24 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall-hint.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgtts/providers/edge.jsView file
11L12: const { execFileSync } = require('child_process');
L13: const fs = require('fs');
High
Child Process
Package source references child process execution.
tts/providers/edge.jsView on unpkg · L11tts/providers/audio8.jsView file
454} catch (e) {}
L455: execSync('sleep 2', { stdio: 'pipe', shell: '/bin/bash' });
L456: }
...
L464: const cfg = require(path.join(__dirname, '..', 'src', 'config'));
L465: const wd = opts.workdir || process.env.ADOREMIX_WORKDIR || path.join(os.homedir(), '.local', 'share', 'adoremix');
L466: cfg.setConfigValue(wd, 'TTS.provider', 'audio8');
L467: cfg.setConfigValue(wd, 'TTS.audio8_base_url', `http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);
L468: logger.ok(`config.ini 已更新: provider=audio8, audio8_base_url=http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`);
Findings
3 Critical16 High7 Medium6 Low
CriticalSame File Env Network Executiontts/providers/audio8.js
CriticalTrigger Reachable Dangerous Capabilitytts/providers/audio8.js
CriticalPrevious Version Dangerous Deltatts/providers/audio8.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processtts/providers/edge.js
HighShelltts/providers/audio8.js
HighTrigger Reachable Persistencetts/providers/audio8.js
HighShips High Entropy Blobaudio8-assets/audio8-tts.tgz
HighKnown Malware Source Similaritysrc/install.js
HighKnown Malware Source Similaritysrc/tts-deps.js
HighKnown Malware Source Similaritysrc/config-manager.js
Affected versions and remediation
This report applies to @oxiaom/adoremix@1.0.60.
See all versions of @oxiaom/adoremix for other recorded verdicts.
- Review the evidence and your use of @oxiaom/adoremix@1.0.60 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.