nixamp@0.53.5
It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThis is a conditional credential-forwarding risk in the remote-server management flow, not evidence of a fixed-recipient theft path. The token is sent automatically to a saved endpoint, so warn about exposure if that endpoint is not controlled by the account owner.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A signed-in user opens the radio page with a saved remote server entry.
Impact
The remote endpoint receives the account token; the inspected source does not establish how that endpoint uses it.
Mechanism
The page fetches the account token, automatically selects a saved server, and uses the token as a bearer credential in requests to that server.
AI rationale
This is a conditional credential-forwarding risk in the remote-server management flow, not evidence of a fixed-recipient theft path. The token is sent automatically to a saved endpoint, so warn about exposure if that endpoint is not controlled by the account owner.
Evidence
web/dist/assets/radio-yD_-qpS7.jsdist/server.js
Decision evidence
public snapshotAI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The browser obtains a Nixamp account token from its same-origin endpoint.
- The browser loads saved server URLs and attaches the account token to remote-server requests.
- On page load, the browser automatically chooses a saved server and connects to it.
- The server API accepts account-associated server entries supplied with a URL.
Evidence against
- The recipient comes from the account’s saved server list; the inspected source does not show a fixed publisher-controlled recipient.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourcedist/speech.jsView file
230try {
L231: return (await import(__rewriteRelativeImportExtension(name)));
L232: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/speech.jsView on unpkg · L230dist/catalogs.jsView file
127* decorates the URL on the next line, `#EXTGRP:News` names the group for
L128: * lists that write it that way instead, and `#EXTIMG:https://...` is the
L129: * picture for lists (a podcast's episodes, say) that carry one that way
...
L209: throw new Error(`${source} answered ${answer.status}`);
L210: const text = await answer.text();
L211: if (text.length > maxBytes)
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/catalogs.jsView on unpkg · L127web/dist/assets/radio-yD_-qpS7.jsView file
Findings
1 Critical2 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationweb/dist/assets/radio-yD_-qpS7.js
HighSandbox Evasion Gated Capabilitydist/manage.js
HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1
MediumDynamic Requiredist/speech.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperweb/dist/install.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowWeak Cryptodist/catalogs.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to nixamp@0.53.5.
See all versions of nixamp for other recorded verdicts.
- Review the evidence and your use of nixamp@0.53.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.