registry / @melaya/runner / 1.0.101
@melaya/runner@1.0.101
⚠ Under reviewRun Melaya AI pipelines locally with your own LM Studio or Ollama models
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/pythonEnv.jsView file
11*/
L12: import { spawn } from "child_process";
L13: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
High
dist/lumaLogin.jsView file
51const child = spawn("npx", ["playwright", "install", "chromium"], {
L52: shell: true,
L53: stdio: ["ignore", "pipe", "pipe"],
High
50progress("Preparing browser for Luma sign-in (one-time setup, ~140 MB)…");
L51: const child = spawn("npx", ["playwright", "install", "chromium"], {
L52: shell: true,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/lumaLogin.jsFindings
1 Critical3 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/connection.js
HighChild Processdist/pythonEnv.js
HighShelldist/lumaLogin.js
HighRuntime Package Installdist/lumaLogin.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/localRagIngest.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @melaya/runner@1.0.101.
See all versions of @melaya/runner for other recorded verdicts.
- Review the evidence and your use of @melaya/runner@1.0.101 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.