registry / Credential exfiltration / nixamp / 0.53.3

nixamp@0.53.3

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The inspected source shows a real token transfer to account-configured remote servers, with no recipient confirmation on the automatic load path. Because server registration is an explicit product feature and no fixed publisher-controlled recipient was found, this supports a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user opens the radio interface while signed in; the interface selects the remembered server or the first listed server and loads its data.

Impact

The selected server receives the account token and may be able to act with the access that token grants.

Mechanism

The interface obtains a token from the same-origin authentication endpoint, attaches it as a bearer credential to requests for the selected server, and omits same-origin cookies for those remote requests.

AI rationale

Evidence

web/dist/assets/radio-ZiViiR-a.jsdist/session.jsdist/server.js

Network endpoints2

nixamp.comHTTP or HTTPS server URLs returned by /api/v1/servers

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The radio interface retrieves a Nixamp account token and the account’s saved server list.
It accepts registered HTTP or HTTPS server URLs and assigns the account token to remote server entries.
Its shared request helper sends that token as a bearer credential to the selected server.
When the interface loads, it uses the saved selection or defaults to the first server and fetches its library and station data.
The CLI supports explicitly registering a server URL, indicating this is a product feature, though the interface does not confirm the token recipient at request time.

Evidence against

The server destinations come from the account’s saved server list, and the CLI allows users to add a URL explicitly; the inspected source does not show a publisher-selected fixed recipient.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

Source & flagged code

7 flagged

dist/speech.jsView file

Lines 210-250javascript

210 return clean;

211}

212export function quietSamples(pcm) {

213 let energy = 0;

214 for (const sample of pcm)

215 energy += sample * sample;

216 return pcm.length === 0 || Math.sqrt(energy / pcm.length) < 0.004;

217}

218/** A two-letter language code, or nothing: Whisper guesses when not told. */

219export function languageOf(value) {

220 if (typeof value !== "string")

221 return undefined;

222 const code = value.trim().toLowerCase();

223 return /^[a-z]{2}$/.test(code) ? code : undefined;

224}

225/** Load the library, or say why not with a status. */

226export async function loadTransformers() {

227 // By name held in a variable: an optional dependency that is not on disk

228 // must fail here, at the first ask, and not when the file is imported.

229 const name = "@huggingface/transformers";

230 try {

231 return (await import(__rewriteRelativeImportExtension(name)));

232 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

233 catch (error) {

234 // The reason travels with the refusal: "not installed" and "installed

235 // but its native runtime would not load" need different fixes, and the

236 // one place this is read is a deployment's log.

237 const why = String(error.message ?? error).split("\n")[0] ?? "";

238 throw new SpeechError(`this nixamp cannot hear: @huggingface/transformers did not load here (${why}). nixamp.com can.`, 503);

239 }

240}

241/**

242 * Which language a clip is in, the way whisper.cpp asks: the encoder once

243 * over the first thirty seconds, one decoder step from the start token,

244 * and the loudest of the language tokens wins. Whisper told nothing

245 * assumes English, and a Swedish sentence heard as English comes back as

246 * the same three English words repeated to the end of the clip; guessing

247 * first costs an encoder pass and is what makes a caption in Swedish say

248 * something. Undefined for a model that knows one language.

249 */

250async function detectLanguage(transformers, asr, pcm) {

dist/catalogs.jsView file

Lines 107-147javascript

107 return "Live TV";

108 return "";

109}

110/** `key="value"` pairs off an #EXTINF line. */

111function attributesOf(text) {

112 const

web/dist/assets/radio-ZiViiR-a.jsView file

Lines 1-1javascript

1import{n as e}from"./chunk-Q2XQMA4B-PTuZPMen.js";import{l as t}from"./remote-DJqvFdE6.js";var n=e=>document.querySelector(e);function r(e

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

dist/ai-label.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nixamp@0.52.2 matchedIdentity = npm:bml4YW1w:0.52.2 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ai-label.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/speech.jsView file

230try { L231: return (await import(__rewriteRelativeImportExtension(name))); L232: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

dist/catalogs.jsView file

127* decorates the URL on the next line, `#EXTGRP:News` names the group for L128: * lists that write it that way instead, and `#EXTIMG:https://...` is the L129: * picture for lists (a podcast's episodes, say) that carry one that way ... L209: throw new Error(`${source} answered ${answer.status}`); L210: const text = await answer.text(); L211: if (text.length > maxBytes)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/catalogs.jsView on unpkg · L127

web/dist/assets/radio-ZiViiR-a.jsView file

Findings

1 Critical3 High5 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationweb/dist/assets/radio-ZiViiR-a.js

HighSandbox Evasion Gated Capabilitydist/manage.js

HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1

HighPrevious Version Dangerous Deltadist/ai-label.js

MediumDynamic Requiredist/speech.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperweb/dist/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/catalogs.js

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to nixamp@0.53.3.

See all versions of nixamp for other recorded verdicts.

Review the evidence and your use of nixamp@0.53.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 06:40:49.029Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.