@oxiaom/adoremix@1.0.68
AdoreMix broadcast server - cross-platform installer, runner and service manager
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package postinstall only prints instructions, so this is not an automatic install-time attack. The explicitly installed configuration manager still exposes OpenClaw credentials and settings over an unauthenticated network service, warranting a warning.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the configuration-manager install command on Linux.
Impact
Network-accessible clients may read provider keys or change the model configuration used by the OpenClaw gateway.
Mechanism
The service listens on all IPv6 interfaces and provides model APIs that return stored API keys and write model settings to the OpenClaw configuration file.
AI rationale
The package postinstall only prints instructions, so this is not an automatic install-time attack. The explicitly installed configuration manager still exposes OpenClaw credentials and settings over an unauthenticated network service, warranting a warning.
Evidence
src/cli.jssrc/config-manager.jsconfig-manager/app.py/root/.openclaw/openclaw.json
Network endpoints1
[::]:9877
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook only prints a manual setup instruction; the exposed service is installed through a separate CLI command.
- The explicit configuration-manager install command creates and enables a system service.
- The service targets the OpenClaw config file and listens on all IPv6 interfaces at port 9877.
- The model GET endpoint returns stored provider API keys in its response.
- The model POST endpoint can change OpenClaw model settings, including API keys and base URLs.
Evidence against
- This service setup is not invoked by the package postinstall hook; it requires the user to run the configuration-manager install command.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
22 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall-hint.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgtts/providers/edge.jsView file
11L12: const { execFileSync } = require('child_process');
L13: const fs = require('fs');
High
Child Process
Package source references child process execution.
tts/providers/edge.jsView on unpkg · L11tts/providers/audio8.jsView file
492try {
L493: execSync(`systemctl --now disable ${AUDIO8_SYSTEMD_NAME} 2>/dev/null; true`, { stdio: 'pipe', shell: '/bin/bash' });
L494: execSync(`systemctl stop ${AUDIO8_SYSTEMD_NAME} 2>/dev/null; true`, { stdio: 'pipe', shell: '/bin/bash' });
...
L507: opts = opts || {};
L508: const baseUrl = opts.url || process.env.ADOREMIX_AUDIO8_BASE_URL || `http://127.0.0.1:${AUDIO8_DEFAULT_PORT}`;
L509: try {
Findings
2 Critical15 High7 Medium6 Low
CriticalSame File Env Network Executiontts/providers/audio8.js
CriticalTrigger Reachable Dangerous Capabilitytts/providers/audio8.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processtts/providers/edge.js
HighShelltts/providers/audio8.js
HighTrigger Reachable Persistencetts/providers/audio8.js
HighRuntime Package Installsrc/mp3server.js
HighShips High Entropy Blobaudio8-assets/audio8-tts.tgz
HighKnown Malware Source Similaritysrc/install.js
HighKnown Malware Source Similaritysrc/config-manager.js
HighKnown Malware Source Similaritysrc/nginx.js
Affected versions and remediation
This report applies to @oxiaom/adoremix@1.0.68.
See all versions of @oxiaom/adoremix for other recorded verdicts.
- Review the evidence and your use of @oxiaom/adoremix@1.0.68 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.