@melaya/runner@1.1.24
Run Melaya AI pipelines locally with your own LM Studio or Ollama models
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package exposes a concrete remote code-execution and credential-handling capability after user-initiated connection. It has no automatic install hook or stealthy install-time behavior, so the source does not establish malware intent.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user starts the runner and the connected server dispatches a pipeline or assistant task.
Impact
A compromised or malicious service can execute code on the runner host and access credentials exposed to the spawned process.
Mechanism
Remote payload download followed by local Python execution with inherited credentials.
AI rationale
The package exposes a concrete remote code-execution and credential-handling capability after user-initiated connection. It has no automatic install hook or stealthy install-time behavior, so the source does not establish malware intent.
Evidence
dist/sharedVendor.jsdist/connection.jsdist/linkedinLogin.js~/.melaya-runner/shared/~/.melaya-runner/venv/main.pyconfig.json
Network endpoints1
api.melaya.org
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The runner downloads server-supplied Python modules into the user cache and executes server-supplied pipeline code.
- The bundle signature is derived from the same runner token sent to the server, so it is not an independent publisher signature.
- Assistant processes inherit environment variables and merge credentials supplied in server payloads.
- It captures third-party LinkedIn session cookies after an interactive login and returns them to its server.
Evidence against
- There is no install, preinstall, or postinstall lifecycle hook.
- Browser downloads require an explicit authorization flag in the provisioner.
- Browser authorization code explicitly blocks cloud metadata and private-network destinations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/codeWorker.jsView file
51// model (--experimental-permission / --permission): fs read/write
L52: // limited to the scratch dir, child_process and worker_threads denied.
L53: //
High
Child Process
Package source references child process execution.
dist/codeWorker.jsView on unpkg · L51288// ulimit -t: hard CPU time in seconds.
L289: // We use /bin/sh -c "ulimit ...; exec sandbox-exec ..." so both limits
L290: // apply before the Node process starts. This is a soft-then-hard pair;
High
dist/browserProvisioner.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @melaya/runner@1.0.93
matchedIdentity = npm:QG1lbGF5YS9ydW5uZXI:1.0.93
similarity = 0.769
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical6 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/browserProvisioner.js
HighChild Processdist/codeWorker.js
HighShelldist/codeWorker.js
HighSandbox Evasion Gated Capabilitydist/browserProvisioner.js
HighCloud Metadata Accessdist/browserAuthz.js
HighRuntime Package Installdist/lumaLogin.js
HighSemantic Analysis Limiteddist/linkedinLogin.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/localRagIngest.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @melaya/runner@1.1.24.
See all versions of @melaya/runner for other recorded verdicts.
- Review the evidence and your use of @melaya/runner@1.1.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.