registry / Credential exfiltration / nixamp / 0.52.2

nixamp@0.52.2

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The inspected source confirms conditional forwarding of an existing session token to configurable account-listed server URLs without a destination trust restriction. This supports a warning for credential exposure, but the source does not establish a publisher-selected recipient or a malicious install-time action.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Opening the radio page while signed in causes it to select a saved or first-listed server and connect automatically.

Impact

A listed server outside the intended trust boundary could receive the account session token.

Mechanism

The page fetches the account session token, associates it with a listed server URL, and uses it as a bearer token in requests to that server.

AI rationale

Evidence

web/dist/assets/radio-B8n_n-WD.jssrc/server.ts

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The signed-in radio page retrieves the existing session token and the account’s server list.
The page accepts HTTP or HTTPS URLs from that list, attaches the session token to remote server entries, and sends it as a bearer token in API requests.
When the page loads, it automatically selects the previously saved server or the first listed server and connects to it.
The server API returns the signed-in account’s server records and accepts records containing a URL.

Evidence against

The transfer is part of the radio page’s server-management feature; the remote server URL comes from the account’s server list rather than a fixed publisher endpoint.
The source shows an authenticated account gate for obtaining the session token and ties server records to the signed-in account.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

Source & flagged code

7 flagged

dist/speech.jsView file

Lines 210-250javascript

210 return clean;

211}

212export function quietSamples(pcm) {

213 let energy = 0;

214 for (const sample of pcm)

215 energy += sample * sample;

216 return pcm.length === 0 || Math.sqrt(energy / pcm.length) < 0.004;

217}

218/** A two-letter language code, or nothing: Whisper guesses when not told. */

219export function languageOf(value) {

220 if (typeof value !== "string")

221 return undefined;

222 const code = value.trim().toLowerCase();

223 return /^[a-z]{2}$/.test(code) ? code : undefined;

224}

225/** Load the library, or say why not with a status. */

226export async function loadTransformers() {

227 // By name held in a variable: an optional dependency that is not on disk

228 // must fail here, at the first ask, and not when the file is imported.

229 const name = "@huggingface/transformers";

230 try {

231 return (await import(__rewriteRelativeImportExtension(name)));

232 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

233 catch (error) {

234 // The reason travels with the refusal: "not installed" and "installed

235 // but its native runtime would not load" need different fixes, and the

236 // one place this is read is a deployment's log.

237 const why = String(error.message ?? error).split("\n")[0] ?? "";

238 throw new SpeechError(`this nixamp cannot hear: @huggingface/transformers did not load here (${why}). nixamp.com can.`, 503);

239 }

240}

241/**

242 * Which language a clip is in, the way whisper.cpp asks: the encoder once

243 * over the first thirty seconds, one decoder step from the start token,

244 * and the loudest of the language tokens wins. Whisper told nothing

245 * assumes English, and a Swedish sentence heard as English comes back as

246 * the same three English words repeated to the end of the clip; guessing

247 * first costs an encoder pass and is what makes a caption in Swedish say

248 * something. Undefined for a model that knows one language.

249 */

250async function detectLanguage(transformers, asr, pcm) {

dist/catalogs.jsView file

Lines 107-147javascript

107 return "Live TV";

108 return "";

109}

110/** `key="value"` pairs off an #EXTINF line. */

111function attributesOf(text) {

112 const

web/dist/assets/radio-B8n_n-WD.jsView file

Lines 1-1javascript

1import{n as e}from"./chunk-Q2XQMA4B-PTuZPMen.js";import{l as t}from"./remote-DJqvFdE6.js";var n=e=>document.querySelector(e);function r(e

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

dist/ai-radio.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nixamp@0.52.1 matchedIdentity = npm:bml4YW1w:0.52.1 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ai-radio.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/speech.jsView file

230try { L231: return (await import(__rewriteRelativeImportExtension(name))); L232: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

dist/catalogs.jsView file

127* decorates the URL on the next line, `#EXTGRP:News` names the group for L128: * lists that write it that way instead, and `#EXTIMG:https://...` is the L129: * picture for lists (a podcast's episodes, say) that carry one that way ... L209: throw new Error(`${source} answered ${answer.status}`); L210: const text = await answer.text(); L211: if (text.length > maxBytes)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/catalogs.jsView on unpkg · L127

web/dist/assets/radio-B8n_n-WD.jsView file

Findings

1 Critical3 High5 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationweb/dist/assets/radio-B8n_n-WD.js

HighSandbox Evasion Gated Capabilitydist/manage.js

HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1

HighPrevious Version Dangerous Deltadist/ai-radio.js

MediumDynamic Requiredist/speech.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperweb/dist/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/catalogs.js

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to nixamp@0.52.2.

See all versions of nixamp for other recorded verdicts.

Review the evidence and your use of nixamp@0.52.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 06:18:34.598Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.