Ive been looking for something to help the navidrome server do its thing, and this looks awesome, but there is one issue that was just opened and closed yesterday, it looks a little sus?
how does one go about digging through and discovering if this is malicious or not?
Ohh that’s suspicious. I’m going to kill mine for now and take a look later tonight. I’ll report back if I find anything interesting!
Ok, so I ran the repo through an LLM to look for any suspicious requests, and it came back clean.
But it’s hella suspicious that the repo owner edited away the issue and closed it without a response.
It’s also hella suspicious that the user that reported that issue created their account yesterday.
I think I need to go the nuclear option: pop a gummy and monitor the network traffic of the container and see what it’s doing.
o7 godspeed! i appreciate you your effort. the spirit of this project does sound so cool so i was a little heartbroken.
enjoy the edible!
Well that was fun! I’m confident this project isn’t malicious. It’s for sure coded using AI, and I think that’s what triggered a smear campaign. This removed Reddit post looks like there is just a downvote brigade out to get the project because the author admitted to using AI.
The only network traffic it’s made when I monitored it was local. Certainly nothing went to Asia.
I think it tries to solve a neat problem. There’s so many features packed in that it’s obviously vibe coded. That’s probably a huge turn off for AI detractors. If you don’t care about that, I think you’re safe to give it a try.