registry / nixamp / 0.23.6

nixamp@0.23.6

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 185 file(s), 3.38 MB of source, external domains: 127.0.0.1, accounts.google.com, acme-v02.api.letsencrypt.org, aomedia.org, api.github.com, api.porkbun.com, api.resend.com, api.telnyx.com, backtoschool.help, bittorrented.com, example.com, github.com, ipinfo.io, nichedb.dev, nixamp.com, nixamp.example.com, oauth2.googleapis.com, openidconnect.googleapis.com, placeholder.invalid, player.vimeo.com, schema.org, server1.chovy.nixamp.com, server1.you.nixamp.com, w.soundcloud.com, www.w3.org, www.youtube-nocookie.com, you.example, your-tunnel.example.com

Source & flagged code

6 flagged

dist/speech.jsView file

Lines 184-224javascript

184 view.setInt16(44 + i * 2, clipped < 0 ? clipped * 32768 : clipped * 32767, true);

185 }

186 return bytes;

187}

188/** Whisper's own spacing and blank-audio tokens, tidied into a line. */

189export function tidy(text) {

190 return text.replace(/\[[A-Z_ ]+\]|$[A-Za-z ]+$/g, " ").replace(/\s+/g, " ").trim();

191}

192/** A two-letter language code, or nothing: Whisper guesses when not told. */

193export function languageOf(value) {

194 if (typeof value !== "string")

195 return undefined;

196 const code = value.trim().toLowerCase();

197 return /^[a-z]{2}$/.test(code) ? code : undefined;

198}

199async function loadWhisper(model, cacheDir) {

200 // By name held in a variable: an optional dependency that is not on disk

201 // must fail here, at the first ask, and not when the file is imported.

202 const name = "@huggingface/transformers";

203 let transformers;

204 try {

205 transformers = (await import(__rewriteRelativeImportExtension(name)));

206 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L204

207 catch (error) {

208 // The reason travels with the refusal: "not installed" and "installed

209 // but its native runtime would not load" need different fixes, and the

210 // one place this is read is a deployment's log.

211 const why = String(error.message ?? error).split("\n")[0] ?? "";

212 throw new SpeechError(`this nixamp cannot hear: @huggingface/transformers did not load here (${why}). nixamp.com can.`, 503);

213 }

214 transformers.env.cacheDir = cacheDir;

215 const recognize = await transformers.pipeline("automatic-speech-recognition", model, { dtype: "q8" });

216 return async (pcm, { language }) => {

217 const heard = await recognize(pcm, {

218 // Whisper hears thirty seconds at a time; longer is heard in overlapping pieces.

219 chunk_length_s: 30,

220 stride_length_s: 5,

221 ...(language ? { language, task: "transcribe" } : {}),

222 });

223 return { text: Array.isArray(heard) ? heard.map((piece) => piece.text).join(" ") : heard.text };

224 };

dist/catalogs.jsView file

Lines 107-147javascript

107 return "Live TV";

108 return "";

109}

110/** `key="value"` pairs off an #EXTINF line. */

111function attributesOf(text) {

112 const

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

dist/voices.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nixamp@0.23.5 matchedIdentity = npm:bml4YW1w:0.23.5 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/voices.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/speech.jsView file

204try { L205: transformers = (await import(__rewriteRelativeImportExtension(name))); L206: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L204

dist/catalogs.jsView file

127* decorates the URL on the next line, `#EXTGRP:News` names the group for L128: * lists that write it that way instead, and `#EXTIMG:https://...` is the L129: * picture for lists (a podcast's episodes, say) that carry one that way ... L208: throw new Error(`${source} answered ${answer.status}`); L209: const text = await answer.text(); L210: if (text.length > maxBytes)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/catalogs.jsView on unpkg · L127

dist/manage.jsView file

8*/ L9: import { spawnSync } from "node:child_process"; L10: import { existsSync, readFileSync } from "node:fs"; ... L12: import { fileURLToPath } from "node:url"; L13: const SITE = "https://nixamp.com"; L14: /** Windows has its own installer, its own shim and its own removal script. */ L15: const windows = process.platform === "win32"; L16: /** ... L21: export function installRoot(from = fileURLToPath(new URL(".", import.meta.url))) { L22: const declared = process.env["NIXAMP_HOME"]; L23: if (declared && existsSync(join(declared, "manifest.json"))) ... L42: try {

Findings

3 High5 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/manage.js

HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1

HighPrevious Version Dangerous Deltadist/voices.js

MediumDynamic Requiredist/speech.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperweb/dist/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/catalogs.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to nixamp@0.23.6.

See all versions of nixamp for other recorded verdicts.

Review the evidence and your use of nixamp@0.23.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 05:10:57.410Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.