@melaya/runner@1.1.14
Run Melaya AI pipelines locally with your own LM Studio or Ollama models
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe runtime code exposes a consequential authenticated Luma registration capability through the saved browser session, while the inspected source does not resolve user authorization for every request. The Claude credential transfer is for model discovery at Anthropic, and no install-time attack or confirmed unauthorized account action was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A runner socket event starts Luma login or a pipeline that uses the Luma bridge.
Impact
A request can act with the saved Luma session; no unauthorized registration was confirmed.
Mechanism
The bridge loads saved Luma browser state and forwards limited requests through a browser context configured to pass Luma’s Cloudflare checks.
AI rationale
The runtime code exposes a consequential authenticated Luma registration capability through the saved browser session, while the inspected source does not resolve user authorization for every request. The Claude credential transfer is for model discovery at Anthropic, and no install-time attack or confirmed unauthorized account action was found.
Evidence
dist/lumaBrowserBridge.jsdist/connection.jsdist/detect.js
Network endpoints2
luma.comapi.anthropic.com/v1/models?limit=100
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The runner reads saved Claude credentials for model discovery and sends a valid access token to Anthropic’s models endpoint.
- The Luma bridge reuses saved browser state for Luma requests and uses a real browser fingerprint to help registration requests pass Cloudflare checks.
- The CLI starts model detection, while Luma login and result handling are activated through runner socket events.
- The bridge restricts forwarded requests to allowed hosts and GET or POST methods; the inspected source does not establish an unwanted account action.
Evidence against
- The manifest has no install lifecycle hook; its prepublishOnly script runs the build.
- Codex credential detection checks for a saved login but reads model names from a cache rather than sending the token.
- The inspected Luma flow is a product connector using the saved session; the source does not establish that its registration action is performed without a user-requested pipeline.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
8 flaggeddist/codeWorker.jsView file
51// model (--experimental-permission / --permission): fs read/write
L52: // limited to the scratch dir, child_process and worker_threads denied.
L53: //
High
Child Process
Package source references child process execution.
dist/codeWorker.jsView on unpkg · L51dist/lumaLogin.jsView file
51const child = spawn("npx", ["playwright", "install", "chromium"], {
L52: shell: true,
L53: stdio: ["ignore", "pipe", "pipe"],
High
50progress("Preparing browser for Luma sign-in (one-time setup, ~140 MB)…");
L51: const child = spawn("npx", ["playwright", "install", "chromium"], {
L52: shell: true,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
Findings
1 Critical6 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/connection.js
HighChild Processdist/codeWorker.js
HighShelldist/lumaLogin.js
HighSandbox Evasion Gated Capabilitydist/browserProvisioner.js
HighCloud Metadata Accessdist/browserAuthz.js
HighRuntime Package Installdist/lumaLogin.js
HighSemantic Analysis Limiteddist/linkedinLogin.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/localRagIngest.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @melaya/runner@1.1.14.
See all versions of @melaya/runner for other recorded verdicts.
- Review the evidence and your use of @melaya/runner@1.1.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.