registry / nixamp / 0.30.3

nixamp@0.30.3

⚠ Under review

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 360 file(s), 7.74 MB of source, external domains: 127.0.0.1, accounts.google.com, acme-v02.api.letsencrypt.org, amzn.to, aomedia.org, api.anthropic.com, api.github.com, api.openai.com, api.porkbun.com, api.resend.com, api.telnyx.com, backtoschool.help, bittorrented.com, crawlproof.com, example.com, github.com, ipinfo.io, iptv-org.github.io, logicsrc.com, nichedb.dev, nixamp.com, nixamp.example.com, oauth2.googleapis.com, openidconnect.googleapis.com, pairux.com, placeholder.invalid, player.vimeo.com, schema.org, server1.chovy.nixamp.com, server1.you.nixamp.com, w.soundcloud.com, www.backtoschool.help, www.w3.org, www.youtube-nocookie.com, you.example, your-tunnel.example.com

Source & flagged code

6 flagged

dist/speech.jsView file

230try { L231: return (await import(__rewriteRelativeImportExtension(name))); L232: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

dist/catalogs.jsView file

Lines 107-147javascript

107 return "Live TV";

108 return "";

109}

110/** `key="value"` pairs off an #EXTINF line. */

111function attributesOf(text) {

112 const found = {};

113 for (const match of text.matchAll(/([A-Za-z][\w-]*)="([^"]*)"/g)) {

114 found[match[1].toLowerCase()] = match[2];

115 }

116 return found;

117}

118/** Trim, flatten, and cut: these strings are written by whoever made the list. */

119function clean(value, max) {

120 return value.replace(/[-]/g, " ").trim().slice(0, max);

121}

122export function entryId(source) {

123 return createHash("sha1").update(source).digest("hex").slice(0, 12);

124}

125/**

126 * Parse an extended m3u: `#EXTINF:-1 tvg-name="CNN" group-title="News",CNN HD`

127 * decorates the URL on the next line, `#EXTGRP:News` names the group for

128 * lists that write it that way instead, and `#EXTIMG:https://...` is the

129 * picture for lists (a podcast's episodes, say) that carry one that way

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/catalogs.jsView on unpkg · L127

130 * rather than as a tvg-logo attribute.

131 */

132export function parseCatalog(text, base) {

133 const out = [];

134 const seen = new Set();

135 let duration = 0;

136 let title = "";

137 let group = "";

138 let logo = "";

139 let grp = "";

140 for (const raw of text.split(/\r?\n/)) {

141 const line = raw.trim();

142 if (line === "")

143 continue;

144 if (line.startsWith("#")) {

145 const info = /^#EXTINF:\s*(-?[\d.]+)\s*(.*)$/i.exec(line);

146 if (info) {

147 const seconds = Number(info[1]);

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

dist/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nixamp@0.28.3 matchedIdentity = npm:bml4YW1w:0.28.3 similarity = 0.617 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/speech.jsView file

230try { L231: return (await import(__rewriteRelativeImportExtension(name))); L232: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

dist/catalogs.jsView file

127* decorates the URL on the next line, `#EXTGRP:News` names the group for L128: * lists that write it that way instead, and `#EXTIMG:https://...` is the L129: * picture for lists (a podcast's episodes, say) that carry one that way ... L209: throw new Error(`${source} answered ${answer.status}`); L210: const text = await answer.text(); L211: if (text.length > maxBytes)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/catalogs.jsView on unpkg · L127

dist/manage.jsView file

8*/ L9: import { spawnSync } from "node:child_process"; L10: import { existsSync, readFileSync } from "node:fs"; ... L12: import { fileURLToPath } from "node:url"; L13: const SITE = "https://nixamp.com"; L14: /** Windows has its own installer, its own shim and its own removal script. */ L15: const windows = process.platform === "win32"; L16: /** ... L21: export function installRoot(from = fileURLToPath(new URL(".", import.meta.url))) { L22: const declared = process.env["NIXAMP_HOME"]; L23: if (declared && existsSync(join(declared, "manifest.json"))) ... L42: try {

Findings

3 High5 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/manage.js

HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1

HighPrevious Version Dangerous Deltadist/server.js

MediumDynamic Requiredist/speech.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperweb/dist/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/catalogs.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to nixamp@0.30.3.

See all versions of nixamp for other recorded verdicts.

Review the evidence and your use of nixamp@0.30.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 10:20:44.071Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.