registry / Credential exfiltration / nixamp / 0.60.2

nixamp@0.60.2

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The source ties token issuance and the destination list to the signed-in account, consistent with the package’s multi-server feature. The page nevertheless forwards the token to dynamically listed hosts without a per-destination confirmation or origin restriction, leaving a credential-exposure risk that warrants a warning.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Opening the radio page while signed in; it loads the account’s server list and fetches data for the selected server.

Impact

A listed server receiving the token may be able to act with the account permissions accepted by that server; the source does not show further collection or use.

Mechanism

The page obtains the current session token, associates it with listed server URLs, and sends it as a bearer credential in API requests.

AI rationale

Evidence

web/dist/assets/radio-DmVc3wpH.jsdist/server.js

Network endpoints3

/api/v1/auth/token/api/v1/serversURLs returned by /api/v1/servers

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The token endpoint returns the current session token after confirming the account is signed in.
The radio page requests that token and loads server URLs from the account’s server list.
The browser attaches the session token as a bearer credential to API requests for a selected remote server.
The server list is retrieved for the signed-in account, so this matches the package’s multi-server management feature.
The page loads the selected server’s data using that server’s session configuration.

Evidence against

Inspected source does not show the token sent to a fixed unrelated recipient, or any additional collection or concealment.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Source & flagged code

9 flagged

dist/links.jsView file

Lines 2-42javascript

2 * Any link, played.

3 *

4 * Paste a YouTube page, a podcast episode, a SoundCloud track, a TikTok live,

5 * and the server works out where the media actually is and plays it to you

6 * the way it plays a catalog entry: as a channel of its own, started for

7 * whoever asked and stopped a minute after the last viewer leaves. The

8 * working-out is yt-dlp's, which knows a thousand sites and is updated

9 * weekly; this module only asks it the right question and reads the answer.

10 *

11 * Two questions, in fact. "Where is it" is `yt-dlp -j`, one JSON object with

12 * the chosen format's direct URL, its title, and whether it is live. "Give it

13 * to me" is `yt-dlp -o -`, the whole file down a pipe, which is what the

14 * Download button hands to the browser -- the server fetches, the person's

15 * own machine keeps it.

16 *

17 * Some sites want a signed-in cookie before they will say anything (YouTube

18 * from a datacenter, Vimeo). A Netscape cookies file at

19 * ~/.local/state/nixamp/cookies.txt is passed through when it exists, and

20 * the error is otherwise repeated to the person, who can decide.

21 */

22import { createHash } from "node:crypto";

23import { spawn } from "node:child_process";

24import { parseCatalog } from "./catalogs.js";

High

Child Process

Package source references child process execution.

dist/links.jsView on unpkg · L22

25/**

26 * Formats that are a file, not a page.

27 *

28 * A link straight to an MP3 or an HLS playlist needs no resolving -- ffmpeg

29 * reads it as it is, and asking yt-dlp about it only adds a second and a

30 * "generic" extractor's guess.

31 */

32const DIRECT = /\.(mp3|m4a|aac|ogg|oga|opus|flac|wav|mp4|m4v|mkv|webm|mov|avi|wmv|flv|mpg|mpeg|m2ts|3gp|ts|m3u8

33export function isDirectMedia(url) {

34 if (/^rtmps?:\/\//i.test(url))

35 return true;

36 try {

37 const parsed = new URL(url);

38 return DIRECT.test(parsed.pathname + parsed.search);

39 }

40 catch {

41 return false;

42 }

dist/speech.jsView file

Lines 210-250javascript

210 return clean;

211}

212export function quietSamples(pcm) {

213 let energy = 0;

214 for (const

dist/catalogs.jsView file

Lines 107-147javascript

107 return "Live TV";

108 return "";

109}

110/** `key="value"` pairs off an #EXTINF line. */

111function attributesOf(text) {

112 const

web/dist/assets/radio-DmVc3wpH.jsView file

Lines 1-1javascript

1import"./modulepreload-polyfill-P2Xu9kJm.js";import{n as e}from"./chunk-Q2XQMA4B-BaoaSqsD.js";import{l as t}from"./remote-DJqvFdE6.js";var n=e=>document.querySelector(e);function

dist/server.jsView file

Lines 1-28javascript

1/**

2 * Server mode: nixamp keeps playing on this machine and hands out a remote.

3 *

4 * nixamp serve ~/Music --port 4321

5 *

6 * The same decode that feeds the speakers feeds the analyser, exactly as in the

7 * terminal app; the HTTP layer only reads the state it produces and writes the

8 * commands a remote sends. State is pushed over Server-Sent Events rather than

9 * a WebSocket because SSE is plain HTTP: no dependency, and it reconnects on

10 * its own when the laptop running the remote goes to sleep.

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

dist/ai-label.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nixamp@0.59.4 matchedIdentity = npm:bml4YW1w:0.59.4 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ai-label.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/links.jsView file

22import { createHash } from "node:crypto"; L23: import { spawn } from "node:child_process"; L24: import { parseCatalog } from "./catalogs.js";

High

Child Process

Package source references child process execution.

dist/links.jsView on unpkg · L22

dist/speech.jsView file

230try { L231: return (await import(__rewriteRelativeImportExtension(name))); L232: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

dist/catalogs.jsView file

127* decorates the URL on the next line, `#EXTGRP:News` names the group for L128: * lists that write it that way instead, and `#EXTIMG:https://...` is the L129: * picture for lists (a podcast's episodes, say) that carry one that way ... L209: throw new Error(`${source} answered ${answer.status}`); L210: const text = await answer.text(); L211: if (text.length > maxBytes)

Findings

2 Critical4 High5 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationweb/dist/assets/radio-DmVc3wpH.js

CriticalPrevious Version Dangerous Deltadist/ai-label.js

HighChild Processdist/links.js

HighCommand Output Exfiltrationdist/server.js

HighSandbox Evasion Gated Capabilitydist/manage.js

HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1

MediumDynamic Requiredist/speech.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperweb/dist/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

Affected versions and remediation

This report applies to nixamp@0.60.2.

See all versions of nixamp for other recorded verdicts.

Review the evidence and your use of nixamp@0.60.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 09:01:10.148Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.