registry / Credential exfiltration / nixamp / 0.59.4

nixamp@0.59.4

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Source inspection confirms that the client forwards an existing service token to account-registered remote server URLs, without showing that the credential is bound to the intended service. This supports a warning for conditional credential exposure, while the source does not establish a package-controlled recipient or other concrete attack behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user signs in and the client selects or switches to a registered remote server.

Impact

The remote endpoint receives a reusable service session credential; the inspected source does not establish that the endpoint is restricted to the intended service or receives a limited token.

Mechanism

The client retrieves the existing token from the same-origin service and uses it as a bearer credential for requests to the remote server URL.

AI rationale

Evidence

web/dist/assets/radio-DmVc3wpH.jsdist/server.js

Network endpoints1

nixamp.com

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The browser client retrieves the signed-in service token from the same-origin authentication endpoint.
It loads server URLs from the signed-in account’s server list and accepts remote HTTP or HTTPS addresses outside the current origin.
The client sends that token as a bearer credential when making requests to a selected remote server.
The server source describes the returned token as the existing session token, not a newly minted limited credential.

Evidence against

The flagged client does not show a hardcoded unrelated recipient; remote destinations come from the account’s server list.
The manifest identifies a CLI application and has no npm lifecycle hook.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

9 flagged

dist/links.jsView file

Lines 2-42javascript

2 * Any link, played.

3 *

4 * Paste a YouTube page, a podcast episode, a SoundCloud track, a TikTok live,

5 * and the server works out where the media actually is and plays it to you

6 * the way it plays a catalog entry: as a channel of its own, started for

7 * whoever asked and stopped a minute after the last viewer leaves. The

8 * working-out is yt-dlp's, which knows a thousand sites and is updated

9 * weekly; this module only asks it the right question and reads the answer.

10 *

11 * Two questions, in fact. "Where is it" is `yt-dlp -j`, one JSON object with

12 * the chosen format's direct URL, its title, and whether it is live. "Give it

13 * to me" is `yt-dlp -o -`, the whole file down a pipe, which is what the

14 * Download button hands to the browser -- the server fetches, the person's

15 * own machine keeps it.

16 *

17 * Some sites want a signed-in cookie before they will say anything (YouTube

18 * from a datacenter, Vimeo). A Netscape cookies file at

19 * ~/.local/state/nixamp/cookies.txt is passed through when it exists, and

20 * the error is otherwise repeated to the person, who can decide.

21 */

22import { createHash } from "node:crypto";

23import { spawn } from "node:child_process";

24import { parseCatalog } from "./catalogs.js";

High

Child Process

Package source references child process execution.

dist/links.jsView on unpkg · L22

25/**

26 * Formats that are a file, not a page.

27 *

28 * A link straight to an MP3 or an HLS playlist needs no resolving -- ffmpeg

29 * reads it as it is, and asking yt-dlp about it only adds a second and a

30 * "generic" extractor's guess.

31 */

32const DIRECT = /\.(mp3|m4a|aac|ogg|oga|opus|flac|wav|mp4|m4v|mkv|webm|mov|avi|wmv|flv|mpg|mpeg|m2ts|3gp|ts|m3u8

33export function isDirectMedia(url) {

34 if (/^rtmps?:\/\//i.test(url))

35 return true;

36 try {

37 const parsed = new URL(url);

38 return DIRECT.test(parsed.pathname + parsed.search);

39 }

40 catch {

41 return false;

42 }

dist/speech.jsView file

Lines 210-250javascript

210 return clean;

211}

212export function quietSamples(pcm) {

213 let energy = 0;

214 for (const

dist/catalogs.jsView file

Lines 107-147javascript

107 return "Live TV";

108 return "";

109}

110/** `key="value"` pairs off an #EXTINF line. */

111function attributesOf(text) {

112 const

web/dist/assets/radio-DmVc3wpH.jsView file

Lines 1-1javascript

1import"./modulepreload-polyfill-P2Xu9kJm.js";import{n as e}from"./chunk-Q2XQMA4B-BaoaSqsD.js";import{l as t}from"./remote-DJqvFdE6.js";var n=e=>document.querySelector(e);function

dist/server.jsView file

Lines 1-28javascript

1/**

2 * Server mode: nixamp keeps playing on this machine and hands out a remote.

3 *

4 * nixamp serve ~/Music --port 4321

5 *

6 * The same decode that feeds the speakers feeds the analyser, exactly as in the

7 * terminal app; the HTTP layer only reads the state it produces and writes the

8 * commands a remote sends. State is pushed over Server-Sent Events rather than

9 * a WebSocket because SSE is plain HTTP: no dependency, and it reconnects on

10 * its own when the laptop running the remote goes to sleep.

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

dist/ai-label.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nixamp@0.59.2 matchedIdentity = npm:bml4YW1w:0.59.2 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ai-label.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/links.jsView file

22import { createHash } from "node:crypto"; L23: import { spawn } from "node:child_process"; L24: import { parseCatalog } from "./catalogs.js";

High

Child Process

Package source references child process execution.

dist/links.jsView on unpkg · L22

dist/speech.jsView file

230try { L231: return (await import(__rewriteRelativeImportExtension(name))); L232: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

dist/catalogs.jsView file

127* decorates the URL on the next line, `#EXTGRP:News` names the group for L128: * lists that write it that way instead, and `#EXTIMG:https://...` is the L129: * picture for lists (a podcast's episodes, say) that carry one that way ... L209: throw new Error(`${source} answered ${answer.status}`); L210: const text = await answer.text(); L211: if (text.length > maxBytes)

Findings

2 Critical4 High5 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationweb/dist/assets/radio-DmVc3wpH.js

CriticalPrevious Version Dangerous Deltadist/ai-label.js

HighChild Processdist/links.js

HighCommand Output Exfiltrationdist/server.js

HighSandbox Evasion Gated Capabilitydist/manage.js

HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1

MediumDynamic Requiredist/speech.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperweb/dist/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

Affected versions and remediation

This report applies to nixamp@0.59.4.

See all versions of nixamp for other recorded verdicts.

Review the evidence and your use of nixamp@0.59.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 08:26:05.640Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.