registry / Credential exfiltration / nixamp / 0.60.4

nixamp@0.60.4

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The browser’s remote-server feature sends an existing session token to a cross-origin URL supplied by the account API, and may select that server automatically. This creates conditional credential exposure, but the source does not establish a publisher-selected recipient or a separate attack chain warranting a block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A signed-in user opens the web interface when a saved or available remote server is selected.

Impact

The remote recipient receives the session token. The inspected code shows no recipient-specific confirmation before this transfer.

Mechanism

The interface fetches the token from the same-origin authentication endpoint, assigns it to a remote server entry, and sends it as a bearer token with requests to that server.

AI rationale

Evidence

web/dist/assets/radio-DmVc3wpH.js

Network endpoints2

/api/v1/auth/token/api/v1/servers

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The browser interface fetches a session token from its same-origin authentication endpoint and uses it in bearer authorization headers for requests to a configured server base.
It builds cross-origin server entries from URLs returned by the account server API and attaches the session token to those entries.
The interface defaults to the previously saved server or the first available server, so the token transfer can occur without a fresh recipient-specific confirmation.

Evidence against

The manifest exposes a CLI entry point and contains no npm lifecycle hook; the observed transfer is in the web interface’s remote-server feature.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Source & flagged code

9 flagged

dist/links.jsView file

Lines 2-42javascript

2 * Any link, played.

3 *

4 * Paste a YouTube page, a podcast episode, a SoundCloud track, a TikTok live,

5 * and the server works out where the media actually is and plays it to you

6 * the way it plays a catalog entry: as a channel of its own, started for

7 * whoever asked and stopped a minute after the last viewer leaves. The

8 * working-out is yt-dlp's, which knows a thousand sites and is updated

9 * weekly; this module only asks it the right question and reads the answer.

10 *

11 * Two questions, in fact. "Where is it" is `yt-dlp -j`, one JSON object with

12 * the chosen format's direct URL, its title, and whether it is live. "Give it

13 * to me" is `yt-dlp -o -`, the whole file down a pipe, which is what the

14 * Download button hands to the browser -- the server fetches, the person's

15 * own machine keeps it.

16 *

17 * Some sites want a signed-in cookie before they will say anything (YouTube

18 * from a datacenter, Vimeo). A Netscape cookies file at

19 * ~/.local/state/nixamp/cookies.txt is passed through when it exists, and

20 * the error is otherwise repeated to the person, who can decide.

21 */

22import { createHash } from "node:crypto";

23import { spawn } from "node:child_process";

24import { parseCatalog } from "./catalogs.js";

High

Child Process

Package source references child process execution.

dist/links.jsView on unpkg · L22

25/**

26 * Formats that are a file, not a page.

27 *

28 * A link straight to an MP3 or an HLS playlist needs no resolving -- ffmpeg

29 * reads it as it is, and asking yt-dlp about it only adds a second and a

30 * "generic" extractor's guess.

31 */

32const DIRECT = /\.(mp3|m4a|aac|ogg|oga|opus|flac|wav|mp4|m4v|mkv|webm|mov|avi|wmv|flv|mpg|mpeg|m2ts|3gp|ts|m3u8

33export function isDirectMedia(url) {

34 if (/^rtmps?:\/\//i.test(url))

35 return true;

36 try {

37 const parsed = new URL(url);

38 return DIRECT.test(parsed.pathname + parsed.search);

39 }

40 catch {

41 return false;

42 }

dist/speech.jsView file

Lines 210-250javascript

210 return clean;

211}

212export function quietSamples(pcm) {

213 let energy = 0;

214 for (const

dist/catalogs.jsView file

Lines 107-147javascript

107 return "Live TV";

108 return "";

109}

110/** `key="value"` pairs off an #EXTINF line. */

111function attributesOf(text) {

112 const

web/dist/assets/radio-DmVc3wpH.jsView file

Lines 1-1javascript

1import"./modulepreload-polyfill-P2Xu9kJm.js";import{n as e}from"./chunk-Q2XQMA4B-BaoaSqsD.js";import{l as t}from"./remote-DJqvFdE6.js";var n=e=>document.querySelector(e);function

dist/server.jsView file

Lines 1-28javascript

1/**

2 * Server mode: nixamp keeps playing on this machine and hands out a remote.

3 *

4 * nixamp serve ~/Music --port 4321

5 *

6 * The same decode that feeds the speakers feeds the analyser, exactly as in the

7 * terminal app; the HTTP layer only reads the state it produces and writes the

8 * commands a remote sends. State is pushed over Server-Sent Events rather than

9 * a WebSocket because SSE is plain HTTP: no dependency, and it reconnects on

10 * its own when the laptop running the remote goes to sleep.

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

Source & flagged code

9 flagged · loading source

dist/links.jsView file

22import { createHash } from "node:crypto"; L23: import { spawn } from "node:child_process"; L24: import { parseCatalog } from "./catalogs.js";

High

Child Process

Package source references child process execution.

dist/links.jsView on unpkg · L22

dist/speech.jsView file

230try { L231: return (await import(__rewriteRelativeImportExtension(name))); L232: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/speech.jsView on unpkg · L230

dist/catalogs.jsView file

127* decorates the URL on the next line, `#EXTGRP:News` names the group for L128: * lists that write it that way instead, and `#EXTIMG:https://...` is the L129: * picture for lists (a podcast's episodes, say) that carry one that way ... L209: throw new Error(`${source} answered ${answer.status}`); L210: const text = await answer.text(); L211: if (text.length > maxBytes)

Findings

2 Critical4 High5 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationweb/dist/assets/radio-DmVc3wpH.js

CriticalPrevious Version Dangerous Deltadist/server.js

HighChild Processdist/links.js

HighCommand Output Exfiltrationdist/server.js

HighSandbox Evasion Gated Capabilitydist/manage.js

HighSemantic Analysis Limiteddist/accounts.js#virtual:string-array:round1

MediumDynamic Requiredist/speech.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperweb/dist/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

Affected versions and remediation

This report applies to nixamp@0.60.4.

See all versions of nixamp for other recorded verdicts.

Review the evidence and your use of nixamp@0.60.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 09:08:58.112Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.