pkg.soopen package index

brew / rank 4403

Install ncmdump with Homebrew, MacPorts, winget

Convert Netease Cloud Music ncm files to mp3/flac files. Version 1.5.1 via Homebrew; verified from local package data. Also installable with macports: sudo port install ncmdump.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install ncmdump

local Homebrew formula metadata

MacPortsverified · 94%
sudo port install ncmdump

MacPorts ports tree · multimedia/ncmdump/Portfile · source: api.github.com

Windows

Windows Package Managerverified · 92%
winget install --id TaurusXin.ncmdump -e

Windows Package Manager source index · TaurusXin.ncmdump · source: cdn.winget.microsoft.com

overview

Package summary

Convert Netease Cloud Music ncm files to mp3/flac files

Commands and aliases

  • ncmdump

history

Project history and usage

ncmdump is a small C++ command-line converter for NetEase Cloud Music `.ncm` cache files. Its README describes converting downloaded NCM cache files to MP3 or FLAC and the Homebrew formula packages the same purpose.

Project history

The GitHub repository was created on 2021-10-06. The README says this C++ version was a cross-platform port and reproduction of the earlier anonymous5l/ncmdump project, which the README says had been deleted, and claims it was the earliest C++ version and first program on the market to support NCM conversion. Version 1.3.0 is called out in the README for fixing filenames containing UTF-8 characters such as Chinese, Japanese, Korean, and emoji, and for adding DLL builds for use from other languages.

Adoption history

ncmdump's adoption is concentrated in the NetEase Cloud Music ecosystem and Chinese-language toolchains. The GitHub page observed for this batch showed about 4.1k stars and 488 forks, while Homebrew, MacPorts, and winget packaging make the CLI available outside ad-hoc binary downloads. The Homebrew formula API response consulted for this July 2026 batch reported 68 install-on-request events in 30 days and 649 in 365 days.

How it is used

The README documents single-file conversion, multiple input files, directory mode with `-d`, recursive traversal with `-r`, output selection with `-o`, source deletion after successful processing with `-m`, and version/help flags. The maintainer has clarified in GitHub Discussions that the tool decrypts and extracts the original MP3 or FLAC data from the `.ncm` file rather than transcoding between formats.

Why package nerds care

ncmdump is a format-escape utility: valuable when a user's music files are locked in NetEase's `.ncm` wrapper and they want normal player/library compatibility. It is niche, but the packaging story matters because users often need a trusted binary instead of random converter sites.

Timeline

  • 2021-10-06: GitHub repository created.
  • 1.3.0: README notes full UTF-8 filename fixes and DLL build support.
  • 2025-10-05: GitHub page observed release 1.5.1 as latest in the rendered releases panel.

Related projects

  • anonymous5l/ncmdump, ncmdump-go, ncmdump-gui, NetEase Cloud Music

security posture

Risk level: orange

infrastructure mutation or orchestration signal.

Risk classifier

orange risk · medium confidence · infrastructure

Why

  • infrastructure mutation or orchestration signal

Signals

  • text:cloud

Install behavior

  • No Homebrew bottle metadata was recorded.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
ncmdumpexecutableindexed executableDiscovered from the local executable index.

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-03
manager version1.5.1
manager updated
local dataunknown
upstreamnot available
latest detectednot detected
  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:ncmdump
Version1.5.1
Package managerHomebrew
Homepagehttps://github.com/taurusxin/ncmdump
Repositoryhttps://github.com/taurusxin/ncmdump
Bottlenot recorded
Servicenone declared

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

MacPorts95%

ncmdump

sudo port install ncmdump
  • normalized package name match
  • Matched by: Ncmdump
MacPorts ports tree · api.github.com · MacPorts ports tree: multimedia/ncmdump/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
winget95%

TaurusXin.ncmdump

winget install --id TaurusXin.ncmdump -e
  • normalized package name match
  • Matched by: Ncmdump
Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: TaurusXin.ncmdump from https://cdn.winget.microsoft.com/cache/source.msix
winget95%

xiSage.ncmdump-net

winget install --id xiSage.ncmdump-net -e
  • normalized package name match
  • Matched by: Ncmdump
Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: xiSage.ncmdump-net from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • pkg.so package database
  • pkgdb category and tag curation