registry / nixamp / 0.37.0

nixamp@0.37.0

⚠ Under review

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 396 file(s), 8.22 MB of source, external domains: 127.0.0.1, accounts.google.com, acme-v02.api.letsencrypt.org, amzn.to, aomedia.org, api.anthropic.com, api.elevenlabs.io, api.github.com, api.openai.com, api.porkbun.com, api.resend.com, api.telnyx.com, backtoschool.help, bittorrented.com, crawlproof.com, example.com, generativelanguage.googleapis.com, github.com, ipinfo.io, iptv-org.github.io, logicsrc.com, nichedb.dev, nixamp.com, nixamp.example.com, oauth2.googleapis.com, openidconnect.googleapis.com, pairux.com, placeholder.invalid, player.vimeo.com, schema.org, server1.chovy.nixamp.com, server1.you.nixamp.com, w.soundcloud.com, www.backtoschool.help, www.w3.org, www.youtube-nocookie.com, you.example, your-tunnel.example.com

Source & flagged code

6 flagged

dist/speech.jsView file

Lines 210-250javascript

210 return clean;

211}

212export function quietSamples(pcm) {

213 let energy = 0;

214 for (const sample of pcm)

215 energy += sample * sample;

216 return pcm.length === 0 || Math.sqrt(energy / pcm.length) < 0.004;

217}

218/** A two-letter language code, or nothing: Whisper guesses when not told. */

219export function languageOf(value) {

220 if (typeof value !== "string")

221 return undefined;

222 const code = value.trim().toLowerCase();

223 return /^[a-z]{2}$/.test(code) ? code : undefined;

224}

225/** Load the library, or say why not with a status. */

226export async function loadTransformers() {

227 // By name held in a variable: an optional dependency that is not on disk

228 // must fail here, at the first ask, and not when the file is imported.

229 const name = "@huggingface/transformers";

230 try {

231 return (await import(__rewriteRelativeImportExtension(name)));

232 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

233 catch (error) {

234 // The reason travels with the refusal: "not installed" and "installed

235 // but its native runtime would not load" need different fixes, and the

236 // one place this is read is a deployment's log.

237 const why = String(error.message ?? error).split("\n")[0] ?? "";

238 throw new SpeechError(`this nixamp cannot hear: @huggingface/transformers did not load here (${why}). nixamp.com can.`, 503);

239 }

240}

241/**

242 * Which language a clip is in, the way whisper.cpp asks: the encoder once

243 * over the first thirty seconds, one decoder step from the start token,

244 * and the loudest of the language tokens wins. Whisper told nothing

245 * assumes English, and a Swedish sentence heard as English comes back as

246 * the same three English words repeated to the end of the clip; guessing

247 * first costs an encoder pass and is what makes a caption in Swedish say

248 * something. Undefined for a model that knows one language.

249 */

250async function detectLanguage(transformers, asr, pcm) {

dist/catalogs.jsView file

Lines 107-147javascript

107 return "Live TV";

108 return "";

109}

110/** `key="value"` pairs off an #EXTINF line. */

111function attributesOf(text) {

112 const

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

dist/ai-radio.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nixamp@0.28.3 matchedIdentity = npm:bml4YW1w:0.28.3 similarity = 0.475 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ai-radio.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/speech.jsView file

230try { L231: return (await import(__rewriteRelativeImportExtension(name))); L232: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

dist/catalogs.jsView file

127* decorates the URL on the next line, `#EXTGRP:News` names the group for L128: * lists that write it that way instead, and `#EXTIMG:https://...` is the L129: * picture for lists (a podcast's episodes, say) that carry one that way ... L209: throw new Error(`${source} answered ${answer.status}`); L210: const text = await answer.text(); L211: if (text.length > maxBytes)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/catalogs.jsView on unpkg · L127

dist/manage.jsView file

8*/ L9: import { spawnSync } from "node:child_process"; L10: import { existsSync, readFileSync } from "node:fs"; ... L12: import { fileURLToPath } from "node:url"; L13: const SITE = "https://nixamp.com"; L14: /** Windows has its own installer, its own shim and its own removal script. */ L15: const windows = process.platform === "win32"; L16: /** ... L21: export function installRoot(from = fileURLToPath(new URL(".", import.meta.url))) { L22: const declared = process.env["NIXAMP_HOME"]; L23: if (declared && existsSync(join(declared, "manifest.json"))) ... L42: try {

Findings

3 High5 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/manage.js

HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1

HighPrevious Version Dangerous Deltadist/ai-radio.js

MediumDynamic Requiredist/speech.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperweb/dist/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/catalogs.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to nixamp@0.37.0.

See all versions of nixamp for other recorded verdicts.

Review the evidence and your use of nixamp@0.37.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 17:03:49.219Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.