registry / nixamp / 0.28.37

nixamp@0.28.37

⚠ Under review

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 320 file(s), 4.87 MB of source, external domains: 127.0.0.1, accounts.google.com, acme-v02.api.letsencrypt.org, aomedia.org, api.anthropic.com, api.elevenlabs.io, api.github.com, api.openai.com, api.porkbun.com, api.resend.com, api.telnyx.com, backtoschool.help, bittorrented.com, coinpayportal.com, example.com, github.com, ipinfo.io, iptv-org.github.io, logicsrc.com, nichedb.dev, nixamp.com, nixamp.example.com, oauth2.googleapis.com, openidconnect.googleapis.com, pairux.com, placeholder.invalid, player.vimeo.com, schema.org, server1.chovy.nixamp.com, server1.you.nixamp.com, w.soundcloud.com, www.w3.org, www.youtube-nocookie.com, you.example, your-tunnel.example.com

Oversized source lightweight scan

web/dist/assets/background.worker-Hz7oaQ8X.js2.12 MB file, sampled 256 KB

Network

Source & flagged code

6 flagged

dist/shared-translation.jsView file

Lines 91-131javascript

91 async join(raw, language, by, send, close) {

92 if (!this.options.voice.available())

93 throw new SpeechError("Translated audio is unavailable.", 503);

94 const source = sharedSource(raw);

95 if (!LIVE_VOICE_LANGUAGES.has(language))

96 throw new SpeechError("Choose a supported audio language.", 400);

97 const id = `dub-${createHash("sha256").update(`${source}|${language}`).digest("hex").slice(0, 40)}`;

98 const capacity = () => {

99 const connections = [...this.feeds.values()].reduce((total, feed) => total + [...feed.members].filter(member => member.by === by).length, 0

100 if (connections >= 2)

101 throw new SpeechError("Translated audio is already open in two players for this account.", 429);

102 const feed = this.feeds.get(id);

103 if (!feed && this.feeds.size >= 4)

104 throw new SpeechError("Live translation is busy. Try again shortly.", 429);

105 if (feed && feed.members.size >= 1000)

106 throw new SpeechError("This translated stream is full. Try again shortly.", 429);

107 };

108 capacity();

109 if (this.options.billing?.begin)

110 await this.options.billing.begin(by, id);

111 else

112 await this.options.billing?.require(by, id);

113 capacity(); // Other joins can finish during the account/database check.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/shared-translation.jsView on unpkg · L111

114 let feed = this.feeds.get(id);

115 if (!feed) {

116 feed = this.make(id, source, language);

117 this.feeds.set(id, feed);

118 const current = feed;

119 current.heartbeat = setInterval(() => void this.checkMembers(current), 10_000);

120 current.heartbeat.unref?.();

121 }

122 const member = { by, send, close };

123 feed.members.add(member);

124 this.broadcast(feed, { type: "status", listeners: feed.members.size });

125 if (feed.members.size === 1 && !feed.input)

126 void this.start(feed);

127 const current = feed;

128 return () => this.leave(current, member);

129 }

130 leave(feed, member) {

131 if (!feed.members.delete(member))

dist/catalogs.jsView file

Lines 107-147javascript

107 return "Live TV";

108 return "";

109}

110/** `key="value"` pairs off an #EXTINF line. */

111function attributesOf(text) {

112 const

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

dist/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nixamp@0.28.3 matchedIdentity = npm:bml4YW1w:0.28.3 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/shared-translation.jsView file

111else L112: await this.options.billing?.require(by, id); L113: capacity(); // Other joins can finish during the account/database check.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/shared-translation.jsView on unpkg · L111

dist/catalogs.jsView file

127* decorates the URL on the next line, `#EXTGRP:News` names the group for L128: * lists that write it that way instead, and `#EXTIMG:https://...` is the L129: * picture for lists (a podcast's episodes, say) that carry one that way ... L209: throw new Error(`${source} answered ${answer.status}`); L210: const text = await answer.text(); L211: if (text.length > maxBytes)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/catalogs.jsView on unpkg · L127

dist/manage.jsView file

Findings

3 High5 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/manage.js

HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1

HighPrevious Version Dangerous Deltadist/server.js

MediumDynamic Requiredist/shared-translation.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperweb/dist/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/catalogs.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to nixamp@0.28.37.

See all versions of nixamp for other recorded verdicts.

Review the evidence and your use of nixamp@0.28.37 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-15 20:44:35.897Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.