registry / Credential exfiltration / nixamp / 0.70.0

nixamp@0.70.0

It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The source confirms that an existing session token can be sent to account-listed remote server URLs without a recipient-specific prompt or destination allowlist. The destinations are user-configured, which limits the finding to conditional credential exposure.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A signed-in user opens the radio page with remote servers in their account list.

Impact

A remote server can receive the account’s session token; the inspected code does not show a recipient-specific confirmation or destination allowlist.

Mechanism

The page retrieves the session token and server list, uses each listed URL as a remote base, and adds the token as a bearer credential to requests to that base.

AI rationale

Evidence

web/dist/assets/radio-DmVc3wpH.jssrc/server.tssrc/session.ts

Network endpoints2

nixamp.com session-token and server-list APIsAccount-configured remote server URLs

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The radio page retrieves the signed-in user’s existing token and the account’s server list.
Listed server URLs become remote API bases; requests to a remote base include the token as a bearer credential.
The server-list API accepts a URL when a signed-in user registers a server, and the CLI accepts a supplied HTTP or HTTPS address.
The token endpoint returns the caller’s existing session token only after confirming the caller is signed in.

Evidence against

The remote destinations come from the account’s server list rather than a hardcoded receiver.
Server registration is an explicit user action, and the reviewed files show no install-time disclosure.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

20 flagged

dist/links.jsView file

Lines 2-42javascript

2 * Any link, played.

3 *

4 * Paste a YouTube page, a podcast episode, a SoundCloud track, a TikTok live,

5 * and the server works out where the media actually is and plays it to you

6 * the way it plays a catalog entry: as a channel of its own, started for

7 * whoever asked and stopped a minute after the last viewer leaves. The

8 * working-out is yt-dlp's, which knows a thousand sites and is updated

9 * weekly; this module only asks it the right question and reads the answer.

10 *

11 * Two questions, in fact. "Where is it" is `yt-dlp -j`, one JSON object with

12 * the chosen format's direct URL, its title, and whether it is live. "Give it

13 * to me" is `yt-dlp -o -`, the whole file down a pipe, which is what the

14 * Download button hands to the browser -- the server fetches, the person's

15 * own machine keeps it.

16 *

17 * Some sites want a signed-in cookie before they will say anything (YouTube

18 * from a datacenter, Vimeo). A Netscape cookies file at

19 * ~/.local/state/nixamp/cookies.txt is passed through when it exists, and

20 * the error is otherwise repeated to the person, who can decide.

21 */

22import { createHash } from "node:crypto";

23import { spawn } from "node:child_process";

24import { parseCatalog } from "./catalogs.js";

High

Child Process

Package source references child process execution.

dist/links.jsView on unpkg · L22

25/**

26 * Formats that are a file, not a page.

27 *

28 * A link straight to an MP3 or an HLS playlist needs no resolving -- ffmpeg

29 * reads it as it is, and asking yt-dlp about it only adds a second and a

30 * "generic" extractor's guess.

31 */

32const DIRECT = /\.(mp3|m4a|aac|ogg|oga|opus|flac|wav|mp4|m4v|mkv|webm|mov|avi|wmv|flv|mpg|mpeg|m2ts|3gp|ts|m3u8

33export function isDirectMedia(url) {

34 if (/^rtmps?:\/\//i.test(url))

35 return true;

36 try {

37 const parsed = new URL(url);

38 return DIRECT.test(parsed.pathname + parsed.search);

39 }

40 catch {

41 return false;

42 }

dist/speech.jsView file

Lines 210-250javascript

210 return clean;

211}

212export function quietSamples(pcm) {

213 let energy = 0;

214 for (const

dist/catalogs.jsView file

Lines 107-147javascript

107 return "Live TV";

108 return "";

109}

110/** `key="value"` pairs off an #EXTINF line. */

111function attributesOf(text) {

112 const

web/dist/assets/radio-DmVc3wpH.jsView file

Lines 1-1javascript

1import"./modulepreload-polyfill-P2Xu9kJm.js";import{n as e}from"./chunk-Q2XQMA4B-BaoaSqsD.js";import{l as t}from"./remote-DJqvFdE6.js";var n=e=>document.querySelector(e);function

dist/server.jsView file

Lines 1-28javascript

1/**

2 * Server mode: nixamp keeps playing on this machine and hands out a remote.

3 *

4 * nixamp serve ~/Music --port 4321

5 *

6 * The same decode that feeds the speakers feeds the analyser, exactly as in the

7 * terminal app; the HTTP layer only reads the state it produces and writes the

8 * commands a remote sends. State is pushed over Server-Sent Events rather than

9 * a WebSocket because SSE is plain HTTP: no dependency, and it reconnects on

10 * its own when the laptop running the remote goes to sleep.

dist/manage.jsView file

Lines 1-28javascript

1/**

2 * `nixamp update` and `nixamp uninstall`.

3 *

4 * Both belong on the CLI rather than in a second script the user has to find.

5 * Removal reads the manifest the installer wrote, so it is exact and works

6 * offline: a tool that needs the network to uninstall itself is one you cannot

7 * remove on a plane.

8 */

9import { spawnSync } from "node:child_process";

web/dist/install.shView file

•path = web/dist/install.sh kind = build_helper sizeBytes = 15393 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

web/dist/install.shView on unpkg

dist/accounts.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 14

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/accounts.js#virtual:string-array:round1View on unpkg

dist/ai-radio.jsView file

•matchType = normalized_sha256 matchedPackage = nixamp@0.62.3 matchedPath = dist/ai-radio.js matchedIdentity = npm:bml4YW1w:0.62.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High