@melaya/runner@1.1.26
Run Melaya AI pipelines locally with your own LM Studio or Ollama models
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no automatic install hook, but its normal runtime design permits opaque server-delivered code to execute locally and handles sensitive credentials and cookies. That is a substantial dangerous capability requiring a warning, not enough source evidence of covert install-time malware.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the CLI with a runner token and the server dispatches a pipeline or connector action.
Impact
A compromised or malicious configured server can execute code with the runner user's permissions and receive captured service sessions.
Mechanism
Remote Python payload execution and credential-backed browser automation.
AI rationale
The package has no automatic install hook, but its normal runtime design permits opaque server-delivered code to execute locally and handles sensitive credentials and cookies. That is a substantial dangerous capability requiring a warning, not enough source evidence of covert install-time malware.
Evidence
dist/sharedVendor.jsdist/connection.jsdist/detect.jsdist/lumaLogin.js~/.melaya-runner/shared/temporary melaya-run-<runId>/main.py~/.melaya/luma/storage-state.json~/.claude/.credentials.json~/.codex/auth.json
Network endpoints4
api.melaya.org/api/v1/runner/shared-bundleapi.anthropic.com/v1/modelswww.linkedin.comluma.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- It downloads server-supplied Python files into the user home cache, then writes and runs server-supplied main.py.
- It reads Claude and Codex authentication files; the Claude token is sent to Anthropic.
- It captures LinkedIn and Luma session cookies and returns them to the connected server.
- It persists browser state specifically to bypass Luma bot rules.
Evidence against
- package.json has no install, postinstall, or preinstall hook; execution starts through the CLI.
- The browser authorization module blocks private, link-local, and cloud metadata destinations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/codeWorker.jsView file
51// model (--experimental-permission / --permission): fs read/write
L52: // limited to the scratch dir, child_process and worker_threads denied.
L53: //
High
Child Process
Package source references child process execution.
dist/codeWorker.jsView on unpkg · L51288// ulimit -t: hard CPU time in seconds.
L289: // We use /bin/sh -c "ulimit ...; exec sandbox-exec ..." so both limits
L290: // apply before the Node process starts. This is a soft-then-hard pair;
High
dist/browserProvisioner.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @melaya/runner@1.0.93
matchedIdentity = npm:QG1lbGF5YS9ydW5uZXI:1.0.93
similarity = 0.769
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical6 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/browserProvisioner.js
HighChild Processdist/codeWorker.js
HighShelldist/codeWorker.js
HighSandbox Evasion Gated Capabilitydist/browserProvisioner.js
HighCloud Metadata Accessdist/browserAuthz.js
HighRuntime Package Installdist/lumaLogin.js
HighSemantic Analysis Limiteddist/linkedinLogin.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/localRagIngest.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @melaya/runner@1.1.26.
See all versions of @melaya/runner for other recorded verdicts.
- Review the evidence and your use of @melaya/runner@1.1.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.