registry / @melaya/runner / 1.0.73
@melaya/runner@1.0.73
Run Melaya AI pipelines locally with your own LM Studio or Ollama models
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/pythonEnv.jsView file
11*/
L12: import { spawn } from "child_process";
L13: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
High
dist/lumaLogin.jsView file
51const child = spawn("npx", ["playwright", "install", "chromium"], {
L52: shell: true,
L53: stdio: ["ignore", "pipe", "pipe"],
High
50progress("Preparing browser for Luma sign-in (one-time setup, ~140 MB)…");
L51: const child = spawn("npx", ["playwright", "install", "chromium"], {
L52: shell: true,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/lumaLogin.jsView on unpkg · L50dist/localRagIngest.pyView file
•path = dist/localRagIngest.py
kind = build_helper
sizeBytes = 25537
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/localRagIngest.pyView on unpkgFindings
3 High4 Medium6 Low
HighChild Processdist/pythonEnv.js
HighShelldist/lumaLogin.js
HighRuntime Package Installdist/lumaLogin.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/localRagIngest.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @melaya/runner@1.0.73.
See all versions of @melaya/runner for other recorded verdicts.
- Review the evidence and your use of @melaya/runner@1.0.73 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.