registry / Credential exfiltration / nixamp / 0.59.2

nixamp@0.59.2

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The client sends a current-origin Nixamp session token to remote server destinations supplied by the authenticated server-list API, without a visible destination allowlist. This is a concrete conditional credential-exposure risk, but the inspected source does not establish hidden collection or a package-controlled recipient.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Opening the radio admin page while signed in and selecting or loading a listed remote server.

Impact

A listed remote server receives the Nixamp session token and may be able to use it as a credential.

Mechanism

The client retrieves a session token, associates it with remote URLs returned by the server-list API, and sends it as a bearer credential in requests to those URLs.

AI rationale

Evidence

web/dist/assets/radio-DmVc3wpH.js

Network endpoints3

/api/v1/auth/token/api/v1/serversremote server URLs returned by /api/v1/servers

Decision evidence

public snapshot

AI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The browser obtains a Nixamp session token from the current origin.
The authenticated server list supplies remote URLs that become destinations paired with that token.
Cross-server API requests send the paired session as a bearer credential; the destination is not restricted to the current origin.

Evidence against

The token and server list are fetched with same-origin credentials, and remote URLs come from the authenticated server-list response.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 446 file(s), 9.16 MB of source, external domains: 127.0.0.1, accounts.google.com, acme-v02.api.letsencrypt.org, amzn.to, aomedia.org, api.anthropic.com, api.cloudflare.com, api.elevenlabs.io, api.github.com, api.openai.com, api.porkbun.com, api.resend.com, api.telnyx.com, backtoschool.help, bittorrented.com, coinpayportal.com, crawlproof.com, example.com, generativelanguage.googleapis.com, github.com, ipinfo.io, iptv-org.github.io, live.streaming, live.streaming.pit.world, logicsrc.com, nichedb.dev, nixamp.com, nixamp.example.com, oauth2.googleapis.com, openidconnect.googleapis.com, pairux.com, pit.world, placeholder.invalid, player.vimeo.com, schema.org, server1.chovy.nixamp.com, server1.you.nixamp.com, server2.example.com, w.soundcloud.com, www.backtoschool.help, www.w3.org, www.youtube-nocookie.com, you.example, your-tunnel.example.com

Source & flagged code

9 flagged

dist/links.jsView file

Lines 2-42javascript

2 * Any link, played.

3 *

4 * Paste a YouTube page, a podcast episode, a SoundCloud track, a TikTok live,

5 * and the server works out where the media actually is and plays it to you

6 * the way it plays a catalog entry: as a channel of its own, started for

7 * whoever asked and stopped a minute after the last viewer leaves. The

8 * working-out is yt-dlp's, which knows a thousand sites and is updated

9 * weekly; this module only asks it the right question and reads the answer.

10 *

11 * Two questions, in fact. "Where is it" is `yt-dlp -j`, one JSON object with

12 * the chosen format's direct URL, its title, and whether it is live. "Give it

13 * to me" is `yt-dlp -o -`, the whole file down a pipe, which is what the

14 * Download button hands to the browser -- the server fetches, the person's

15 * own machine keeps it.

16 *

17 * Some sites want a signed-in cookie before they will say anything (YouTube

18 * from a datacenter, Vimeo). A Netscape cookies file at

19 * ~/.local/state/nixamp/cookies.txt is passed through when it exists, and

20 * the error is otherwise repeated to the person, who can decide.

21 */

22import { createHash } from "node:crypto";

23import { spawn } from "node:child_process";

24import { parseCatalog } from "./catalogs.js";

High

Child Process

Package source references child process execution.

dist/links.jsView on unpkg · L22

25/**

26 * Formats that are a file, not a page.

27 *

28 * A link straight to an MP3 or an HLS playlist needs no resolving -- ffmpeg

29 * reads it as it is, and asking yt-dlp about it only adds a second and a

30 * "generic" extractor's guess.

31 */

32const DIRECT = /\.(mp3|m4a|aac|ogg|oga|opus|flac|wav|mp4|m4v|mkv|webm|mov|avi|wmv|flv|mpg|mpeg|m2ts|3gp|ts|m3u8

33export function isDirectMedia(url) {

34 if (/^rtmps?:\/\//i.test(url))

35 return true;

36 try {

37 const parsed = new URL(url);

38 return DIRECT.test(parsed.pathname + parsed.search);

39 }

40 catch {

41 return false;

42 }

dist/speech.jsView file

Lines 210-250javascript

210 return clean;

211}

212export function quietSamples(pcm) {

213 let energy = 0;

214 for (const

dist/catalogs.jsView file

Lines 107-147javascript

107 return "Live TV";

108 return "";

109}

110/** `key="value"` pairs off an #EXTINF line. */

111function attributesOf(text) {

112 const

web/dist/assets/radio-DmVc3wpH.jsView file

Lines 1-1javascript

1import"./modulepreload-polyfill-P2Xu9kJm.js";import{n as e}from"./chunk-Q2XQMA4B-BaoaSqsD.js";import{l as t}from"./remote-DJqvFdE6.js";var n=e=>document.querySelector(e);function

dist/server.jsView file

Lines 1-28javascript

1/**

2 * Server mode: nixamp keeps playing on this machine and hands out a remote.

3 *

4 * nixamp serve ~/Music --port 4321

5 *

6 * The same decode that feeds the speakers feeds the analyser, exactly as in the

7 * terminal app; the HTTP layer only reads the state it produces and writes the

8 * commands a remote sends. State is pushed over Server-Sent Events rather than

9 * a WebSocket because SSE is plain HTTP: no dependency, and it reconnects on

10 * its own when the laptop running the remote goes to sleep.

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

dist/ai-label.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nixamp@0.53.5 matchedIdentity = npm:bml4YW1w:0.53.5 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ai-label.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/links.jsView file

22import { createHash } from "node:crypto"; L23: import { spawn } from "node:child_process"; L24: import { parseCatalog } from "./catalogs.js";

High

Child Process

Package source references child process execution.

dist/links.jsView on unpkg · L22

dist/speech.jsView file

230try { L231: return (await import(__rewriteRelativeImportExtension(name))); L232: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

dist/catalogs.jsView file

127* decorates the URL on the next line, `#EXTGRP:News` names the group for L128: * lists that write it that way instead, and `#EXTIMG:https://...` is the L129: * picture for lists (a podcast's episodes, say) that carry one that way ... L209: throw new Error(`${source} answered ${answer.status}`); L210: const text = await answer.text(); L211: if (text.length > maxBytes)

Findings

2 Critical4 High5 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationweb/dist/assets/radio-DmVc3wpH.js

CriticalPrevious Version Dangerous Deltadist/ai-label.js

HighChild Processdist/links.js

HighCommand Output Exfiltrationdist/server.js

HighSandbox Evasion Gated Capabilitydist/manage.js

HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1

MediumDynamic Requiredist/speech.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperweb/dist/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

Affected versions and remediation

This report applies to nixamp@0.59.2.

See all versions of nixamp for other recorded verdicts.

Review the evidence and your use of nixamp@0.59.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 08:01:29.354Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.