registry / nixamp / 0.21.2

nixamp@0.21.2

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 167 file(s), 3.13 MB of source, external domains: 127.0.0.1, accounts.google.com, acme-v02.api.letsencrypt.org, aomedia.org, api.github.com, api.porkbun.com, api.resend.com, api.telnyx.com, backtoschool.help, bittorrented.com, example.com, github.com, ipinfo.io, nichedb.dev, nixamp.com, nixamp.example.com, oauth2.googleapis.com, openidconnect.googleapis.com, placeholder.invalid, player.vimeo.com, schema.org, server1.you.nixamp.com, w.soundcloud.com, www.w3.org, www.youtube-nocookie.com, your-tunnel.example.com

Source & flagged code

5 flagged

dist/catalogs.jsView file

Lines 183-223javascript

183 logo = "";

184 }

185 return out;

186}

187const INDEX = "catalogs.json";

188/** Read a list, from disk or over the network, within reason. */

189export async function readCatalog(source, send = fetch, maxBytes = MAX_LIST_BYTES) {

190 const tooBig = `that list is bigger than ${Math.round(maxBytes / (1024 * 1024))} MB, which is not a playlist`;

191 if (!isRemote(source)) {

192 const text = readFileSync(source, "utf8");

193 if (text.length > maxBytes)

194 throw new Error(tooBig);

195 return text;

196 }

197 const answer = await send(source, {

198 redirect: "follow",

199 headers: { accept: "audio/x-mpegurl, application/x-mpegurl, text/plain, */*" },

200 signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),

201 });

202 if (!answer.ok)

203 throw new Error(`${source} answered ${answer.status}`);

204 const text = await answer.text();

205 if (text.length > maxBytes)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/catalogs.jsView on unpkg · L203

206 throw new Error(tooBig);

207 return text;

208}

209/**

210 * The catalogs on one server, and their entries.

211 *

212 * The index is small and written whenever it changes; each catalog's entries

213 * are kept in their own file so a restart does not have to ask every provider

214 * again before anybody can browse.

215 */

216export class Catalogs {

217 dir;

218 port;

219 send;

220 stored = new Map();

221 entries = new Map();

222 constructor(dir, port, send = fetch) {

223 this.dir = dir;

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

dist/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nixamp@0.20.2 matchedIdentity = npm:bml4YW1w:0.20.2 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/catalogs.jsView file

203throw new Error(`${source} answered ${answer.status}`); L204: const text = await answer.text(); L205: if (text.length > maxBytes)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/catalogs.jsView on unpkg · L203

dist/manage.jsView file

8*/ L9: import { spawnSync } from "node:child_process"; L10: import { existsSync, readFileSync } from "node:fs"; ... L12: import { fileURLToPath } from "node:url"; L13: const SITE = "https://nixamp.com"; L14: /** Windows has its own installer, its own shim and its own removal script. */ L15: const windows = process.platform === "win32"; L16: /** ... L21: export function installRoot(from = fileURLToPath(new URL(".", import.meta.url))) { L22: const declared = process.env["NIXAMP_HOME"]; L23: if (declared && existsSync(join(declared, "manifest.json"))) ... L42: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/manage.jsView on unpkg · L8

web/dist/install.sh

Findings

3 High4 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/manage.js

HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1

HighPrevious Version Dangerous Deltadist/server.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperweb/dist/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/catalogs.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to nixamp@0.21.2.

See all versions of nixamp for other recorded verdicts.

Review the evidence and your use of nixamp@0.21.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 18:12:12.758Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.