@melaya/runner@1.0.83
Run Melaya AI pipelines locally with your own LM Studio or Ollama models
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection confirms intentional server-directed code execution rather than a concrete malicious install-time chain. Flag as suspicious because the remote-control capability runs with local user privileges and reads third-party CLI authentication state.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `melaya-runner` and connects with `--token`.
Impact
The configured Melaya server can execute Python with the runner user's permissions.
Mechanism
Token-authenticated remote Python bundle retrieval and subprocess execution.
AI rationale
Source inspection confirms intentional server-directed code execution rather than a concrete malicious install-time chain. Flag as suspicious because the remote-control capability runs with local user privileges and reads third-party CLI authentication state.
Evidence
package.jsondist/connection.jsdist/sharedVendor.jsdist/detect.jsdist/pythonEnv.jsdist/lumaLogin.js~/.melaya-runnertemporary `melaya-run-*` directories
Network endpoints5
wss://api.melaya.org/api/v1/runnerapi.melaya.org/api/v1/runner/shared-bundleapi.anthropic.com/v1/models127.0.0.1:1234/v1/models127.0.0.1:11434/api/tags
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `dist/connection.js` accepts `runner:run`, writes server-supplied Python, and spawns it.
- `dist/sharedVendor.js` downloads and writes a runtime Python bundle under `~/.melaya-runner`.
- `dist/detect.js` reads `~/.claude/.credentials.json` and `~/.codex/auth.json`.
- `dist/lumaLogin.js` invokes `npx playwright install chromium` at runtime.
Evidence against
- `package.json` has no preinstall/install/postinstall hook; only `prepublishOnly`.
- Remote bundle and pipeline content require HMAC verification using the supplied runner token.
- Credential reads are used for local model detection; no source path sends their raw contents to Melaya.
- Writes are limited to runner cache and temporary run directories; no AI-agent config mutation found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
5 flaggeddist/pythonEnv.jsView file
11*/
L12: import { spawn } from "child_process";
L13: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
High
dist/lumaLogin.jsView file
51const child = spawn("npx", ["playwright", "install", "chromium"], {
L52: shell: true,
L53: stdio: ["ignore", "pipe", "pipe"],
High
50progress("Preparing browser for Luma sign-in (one-time setup, ~140 MB)…");
L51: const child = spawn("npx", ["playwright", "install", "chromium"], {
L52: shell: true,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/lumaLogin.jsFindings
1 Critical3 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/connection.js
HighChild Processdist/pythonEnv.js
HighShelldist/lumaLogin.js
HighRuntime Package Installdist/lumaLogin.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/localRagIngest.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @melaya/runner@1.0.83.
See all versions of @melaya/runner for other recorded verdicts.
- Review the evidence and your use of @melaya/runner@1.0.83 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.