PixelPlayerHQ/PixelPlayer
We ran PixelPlayerHQ/PixelPlayer, a unknown project, in an isolated sandbox. The project did not build to a runnable state. We observed no malicious behavior, credential access, or outbound exfiltration. Its score is held down by a new owner account.
High engagement, but account age is a concern.
The owner account 'PixelPlayerHQ' is only 28 days old, which is a common pattern for newly created or potentially hijacked accounts.
The README links point to a different user ('theovilardo') than the current repository owner ('PixelPlayerHQ'), suggesting a potential transfer or fork history that should be verified.
Three agents — install-time, runtime, and payload — read the source in parallel and cross-verified. These are their inferences from reading the code; the runtime facts below are what actually happened when we ran it.
Agent analysis (code read, not a runtime observation): This file is a **Room Database schema definition** (JSON format) for an Android application, specifically `PixelPlayDatabase`. ### Analysis * **Nature of the file:** This is a static configuration file generated by the Android Room persistence library. It defines the database structure (tables, columns, indices, and foreign keys) for version 25 of the app's database. * **Content:** The schema defines tables for music-related data: `songs`, `albums`, `artists`, `lyrics`, `favorites`, and integration-specific tables for `telegram_songs`, `netease_songs`, and `gdrive_songs`. * **Risk Assessment:** This file is **data, not code**. It does not contain executable logic, scripts, or obfuscated payloads. It is a declarative description of a SQL schema. There is no mechanism for this file to "run" or perform actions on a system. ### Conclusion There is no malicious behavior to observe in this file. It is a standard component of an Android application's data layer. **Detonation:** Not required. Detonating a static JSON schema file would yield no behavioral data, as it is not an executable or a script.
Agent analysis (code read, not a runtime observation): This file is a Room database schema definition (JSON) for an Android application named `PixelPlay`. It describes the structure of various tables, including `songs`, `playlists`, `telegram_songs`, `netease_songs`, and `gdrive_songs`. ### Analysis * **Nature of File:** This is a static configuration file used by the Android Room persistence library to manage database migrations and schema validation. It is not executable code. * **Functionality:** It defines the schema for a music player application that appears to support local files, Telegram-based music, NetEase, and Google Drive integration. * **Suspicion Level:** Low. The file structure is standard for an Android project using Room. There are no signs of obfuscation, malicious SQL injection, or suspicious data exfiltration logic within this schema definition. ### Conclusion This file does not contain executable code and does not warrant detonation. It is a declarative schema definition. No malicious behavior was observed in this file.
Agent analysis (code read, not a runtime observation): This file is a Room database schema definition (`27.json`) for an Android application named `PixelPlay`. It describes the structure of various tables, including `songs`, `albums`, `artists`, `playlists`, and integration-specific tables like `telegram_songs`, `netease_songs`, and `gdrive_songs`. ### Analysis * **Nature of the file:** This is a static configuration file used by the Android Room persistence library to manage database migrations and schema validation. It is not executable code. * **Content:** The schema defines standard music player data structures. The presence of `telegram_songs` and `gdrive_songs` tables suggests the app integrates with Telegram and Google Drive to fetch or manage music files. * **Suspicion:** While the file itself is benign (it is just a JSON schema), the *intent* of the application using this schema should be verified by examining the code that interacts with these tables (e.g., how it handles Telegram chat IDs or Google Drive file IDs). ### Conclusion There is no malicious behavior to observe by "detonating" a JSON schema file, as it contains no logic. **Recommendation:** No detonation is required for this file. Instead, I will focus on identifying the source code that implements the logic for the `telegram_songs` and `gdrive_songs` features, as those are the likely areas where credential handling or data exfiltration could occur. I will proceed to explore the repository to find the corresponding DAO (Data Access Object) or repository classes.
No outbound connection attempts were observed during this run.
A control probe confirmed the sandbox intercepts all egress (the microVM has no route to the real internet except the forge) and a direct UDP query was dropped (non-TCP egress contained). The detonation itself made no outbound connection attempts during this run.