Scan report

bjarneo / cliamp

View on GitHub (opens in a new tab)
Go
4321 stars
Scanned 24 Sep 2026, 10:11

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

71 risk score

Real issues worth reviewing before you rely on this code.

High: 4
Medium: 32
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

8 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 7
Medium: 2
Low: 3

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

48 total findings

Likely real: 33
Uncertain: 7
Likely noise: 8

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a medium vulnerability score of 71, which means there are several insecure coding patterns that an attacker could exploit to steal secrets or code. These issues look more like ordinary mistakes in how the code is written rather than signs of intentional malicious intent. However, the scan also found some dangerous combinations, such as downloading files and executing them directly from the internet, which poses a significant threat if those files contain harmful content. While there are other minor risks like using weak encryption methods or missing security settings, they do not appear to be the primary concern for immediate use. Overall, while the code has flaws that need fixing, the presence of these specific dangerous patterns suggests it should not be used without careful review and remediation.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 36

Pattern-based code analysis · Vulnerability
YARA 8

Malware signature rules · Malicious pattern
GuardDog 4

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/aur.yml line 20

Likely real
Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
```
run: |
          TAG="${{ github.event.workflow_run.head_branch }}"
          echo "pkgver=${TAG#v}" >> "$GITHUB_OUTPUT"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/external/tidal/creds.go line 22

Likely real
Yes, 50% confidence

Generic Secret detected
```
fallbackClientSecret = "1Nn9AfDAjxrgJFJbKNWLeAyKGVGmINuXPPLHVXAvxAg="
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/cmd/protocol.go line 116

Likely real
Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
_ = exec.Command(name, args...).Run()
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/luaplugin/api_exec.go line 240

Likely real
Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
cmd := exec.CommandContext(ctx, path, argv...)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/aur.yml line 13

Likely real
Yes, 100% confidence

This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.
```
- name: Checkout
        uses: actions/checkout@v7.0.0
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/lyrics/lyrics.go line 186

Likely real
Yes, 99% confidence

Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.
```
req, err := http.NewRequest("POST", "http://music.163.com/api/search/get/web", strings.NewReader(data.Encode()))
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/external/radio/stats.go line 19

Likely real
Yes, 98% confidence

Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
```
// sends nothing about where it is running.
const StatsURL = "https://radio.cliamp.stream/statistics"

// maxStatsBody bounds the statistics document; it is tens of kilobytes.
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/external/radio/provider.go line 46

Likely real
Yes, 98% confidence

Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration]
```
// so both show the same channels, in the same order, under the same titles.
const BuiltinURL = "https://radio.cliamp.stream/streams.m3u"

// Section headings for each ID prefix, shown above the rows they cover in the
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/external/spotify/session.go line 420

Likely real
Yes, 57% confidence

An HTTP redirect was found to be crafted from user-input `r`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist.
```
http.Redirect(w, r, pending[flow+1].authURL, http.StatusFound)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/luaplugin/api_crypto.go line 18

Likely real
Yes, 53% confidence

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
h := md5.Sum([]byte(s))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/external/qobuz/client.go line 62

Likely real
Yes, 53% confidence

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
return fmt.Sprintf("%x", md5.Sum([]byte(s)))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/external/navidrome/client.go line 196

Likely real
Yes, 53% confidence

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
hash := md5.Sum([]byte(c.password + salt))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/external/yandex/client.go line 386

Likely real
Yes, 52% confidence

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
sum := md5.Sum([]byte(trackURISecret + full.Path[1:] + full.S))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/httpclient/client.go line 231

Likely real
Yes, 52% confidence

`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.
```
config := &tls.Config{}
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 320

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/download-artifact@v8.0.1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 309

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/upload-artifact@v7.0.1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 300

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: softprops/action-gh-release@v3.0.1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/pages.yml line 34

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/upload-pages-artifact@v5.0.0
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 231

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/download-artifact@v8.0.1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 226

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v7.0.0
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 206

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/upload-artifact@v7.0.1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 37

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-go@v6.5.0
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 34

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v7.0.0
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/pages.yml line 38

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/deploy-pages@v5.0.0
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/pages.yml line 33

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/configure-pages@v6.0.0
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/pages.yml line 30

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v7.0.1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 69

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: msys2/setup-msys2@v2
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/aur.yml line 14

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v7.0.0
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 81

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: msys2/setup-msys2@v2
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 19

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v7.0.1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 46

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/setup-go@v7.0.0
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 43

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v7.0.1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 22

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/setup-go@v7.0.0
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/playlist/playlist.go line 6

Likely real
Uncertain, 39% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
"math/rand"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/external/qobuz/provider.go line 6

Likely real
Uncertain, 38% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
"math/rand/v2"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/site/index.html line 622

Likely real
Uncertain, 36% confidence

This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
```
<script src="https://cdn.jsdelivr.net/npm/d3-geo@3.1.1/dist/d3-geo.min.js"></script>
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/site/index.html line 623

Likely real
Uncertain, 36% confidence

This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
```
<script src="https://cdn.jsdelivr.net/npm/topojson-client@3.1.0/dist/topojson-client.min.js"></script>
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/site/index.html line 621

Likely real
Uncertain, 36% confidence

This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
```
<script src="https://cdn.jsdelivr.net/npm/d3-array@3.2.4/dist/d3-array.min.js"></script>
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/external/navidrome/client.go line 117

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
cfg.User = os.Getenv("NAVIDROME_USER")
	cfg.Password = os.Getenv("NAVIDROME_PASS")
	return NewFromConfig(cfg)
}
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/external/lyrion/client.go line 119

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
}
	c := New(u, os.Getenv("LYRION_USER"), os.Getenv("LYRION_PASS"))
	c.showUnplayable = strings.EqualFold(os.Getenv("LYRION_SHOW_UNPLAYABLE"), "true")
	return c
```