registry / @oxiaom/adoremix / 1.0.62
@oxiaom/adoremix@1.0.62
⚠ Under reviewAdoreMix broadcast server - cross-platform installer, runner and service manager
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe package’s postinstall hook only prints setup guidance, while the oversized embedded Audio8 archive could not be inspected. Review its contents before clearing the remaining uncertainty.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The package describes the archive as part of the separate Audio8 installation flow.
Impact
Unknown; no harmful behavior was verified.
Mechanism
That flow extracts the embedded archive into the Audio8 directory; the archive contents were not inspectable through the available source tools.
AI rationale
The package’s postinstall hook only prints setup guidance, while the oversized embedded Audio8 archive could not be inspected. Review its contents before clearing the remaining uncertainty.
Evidence
audio8-assets/audio8-tts.tgztts/providers/audio8.js~/audio8
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The postinstall hook runs a hint script that tells users to run setup commands.
- The Audio8 provider uses an embedded source archive during its Audio8 installation flow.
- The archive exceeds the citation verifier’s size limit, and its binary contents could not be inspected.
Evidence against
- The inspected postinstall hint only prints next steps; setup is directed to a separate command.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
24 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall-hint.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgtts/providers/edge.jsView file
11L12: const { execFileSync } = require('child_process');
L13: const fs = require('fs');
High
Child Process
Package source references child process execution.
tts/providers/edge.jsView on unpkg · L11tts/providers/audio8.jsView file
492try {
L493: execSync(`systemctl --now disable ${AUDIO8_SYSTEMD_NAME} 2>/dev/null; true`, { stdio: 'pipe', shell: '/bin/bash' });
L494: execSync(`systemctl stop ${AUDIO8_SYSTEMD_NAME} 2>/dev/null; true`, { stdio: 'pipe', shell: '/bin/bash' });
...
L507: opts = opts || {};
L508: const baseUrl = opts.url || process.env.ADOREMIX_AUDIO8_BASE_URL || `http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`;
L509: try {
Findings
3 Critical16 High7 Medium6 Low
CriticalSame File Env Network Executiontts/providers/audio8.js
CriticalTrigger Reachable Dangerous Capabilitytts/providers/audio8.js
CriticalPrevious Version Dangerous Deltatts/providers/audio8.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processtts/providers/edge.js
HighShelltts/providers/audio8.js
HighTrigger Reachable Persistencetts/providers/audio8.js
HighShips High Entropy Blobaudio8-assets/audio8-tts.tgz
HighKnown Malware Source Similaritysrc/install.js
HighKnown Malware Source Similaritysrc/tts-deps.js
HighKnown Malware Source Similaritysrc/config-manager.js
Affected versions and remediation
This report applies to @oxiaom/adoremix@1.0.62.
See all versions of @oxiaom/adoremix for other recorded verdicts.
- Review the evidence and your use of @oxiaom/adoremix@1.0.62 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.