registry / @oxiaom/adoremix / 1.0.64
@oxiaom/adoremix@1.0.64
⚠ Under reviewAdoreMix broadcast server - cross-platform installer, runner and service manager
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe readable lifecycle hook is informational, and the unresolved behavior is behind an explicit CLI install command. The bundled archive could not be inspected, so its service runtime remains unresolved and warrants manual review.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs the separate Audio8 install command.
Impact
The runtime behavior of the bundled code remains unknown, so its effect cannot be assessed from the readable source.
Mechanism
The installer extracts the bundled archive, installs Python requirements, and configures a system service to run its Python module.
AI rationale
The readable lifecycle hook is informational, and the unresolved behavior is behind an explicit CLI install command. The bundled archive could not be inspected, so its service runtime remains unresolved and warrants manual review.
Evidence
audio8-assets/audio8-tts.tgztts/providers/audio8.jssrc/cli.js
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The postinstall hook runs a helper script.
- The helper directs users to run setup commands after installation.
- Audio8 service setup is exposed as a separate CLI install command.
- That installer extracts the bundled Audio8 archive into the user's home directory.
- The installer creates a Python environment, installs its requirements, and registers a system service.
- The service runs a Python module from the installed Audio8 runtime.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
22 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall-hint.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgtts/providers/edge.jsView file
11L12: const { execFileSync } = require('child_process');
L13: const fs = require('fs');
High
Child Process
Package source references child process execution.
tts/providers/edge.jsView on unpkg · L11tts/providers/audio8.jsView file
492try {
L493: execSync(`systemctl --now disable ${AUDIO8_SYSTEMD_NAME} 2>/dev/null; true`, { stdio: 'pipe', shell: '/bin/bash' });
L494: execSync(`systemctl stop ${AUDIO8_SYSTEMD_NAME} 2>/dev/null; true`, { stdio: 'pipe', shell: '/bin/bash' });
...
L507: opts = opts || {};
L508: const baseUrl = opts.url || process.env.ADOREMIX_AUDIO8_BASE_URL || `http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`;
L509: try {
Findings
3 Critical14 High7 Medium6 Low
CriticalSame File Env Network Executiontts/providers/audio8.js
CriticalTrigger Reachable Dangerous Capabilitytts/providers/audio8.js
CriticalPrevious Version Dangerous Deltasrc/tts-deps.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processtts/providers/edge.js
HighShelltts/providers/audio8.js
HighTrigger Reachable Persistencetts/providers/audio8.js
HighShips High Entropy Blobaudio8-assets/audio8-tts.tgz
HighKnown Malware Source Similaritysrc/install.js
HighKnown Malware Source Similaritysrc/config-manager.js
HighKnown Malware Source Similaritysrc/nginx.js
Affected versions and remediation
This report applies to @oxiaom/adoremix@1.0.64.
See all versions of @oxiaom/adoremix for other recorded verdicts.
- Review the evidence and your use of @oxiaom/adoremix@1.0.64 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.