@melaya/runner@1.1.33
Run Melaya AI pipelines locally with your own LM Studio or Ollama models
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes a real remote-code-execution and credential/session-handling capability, but it is activated through the package's explicit runner workflow rather than covert installation behavior. Static inspection does not establish a separate malicious endpoint or unconsented install hook.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs melaya-runner with a token and the connected service sends a pipeline or login request.
Impact
A compromised or malicious configured service could execute code with the runner user's permissions and use persisted service sessions.
Mechanism
Authenticated remote bundle delivery, local Python execution, and browser-session persistence.
AI rationale
The source establishes a real remote-code-execution and credential/session-handling capability, but it is activated through the package's explicit runner workflow rather than covert installation behavior. Static inspection does not establish a separate malicious endpoint or unconsented install hook.
Evidence
dist/sharedVendor.jsdist/connection.jsdist/lumaLogin.jsdist/detect.js~/.melaya-runner/shared/temporary melaya-run-<runId>/main.py~/.melaya/luma/storage-state.json
Network endpoints2
${serverUrl}/api/v1/runner/shared-bundleluma.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The runner downloads a server-supplied Python bundle and writes its files into a persistent user cache.
- A socket event accepts Python source, writes it to main.py, and starts it as a subprocess.
- The Luma flow saves browser session state, including authentication material, for later automated use.
- The package accesses local AI-provider credentials to query provider APIs.
Evidence against
- package.json has no install, preinstall, or postinstall hook; its only lifecycle script is prepublishOnly.
- The executable requires an explicit CLI invocation and runner token.
- Browser provisioning requires an explicit download option in its dedicated provisioner.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/uvBootstrap.jsView file
20import { homedir, platform, arch } from "os";
L21: import { spawn, execSync } from "child_process";
L22: const CACHE_DIR = join(homedir(), ".melaya-runner");
High
Child Process
Package source references child process execution.
dist/uvBootstrap.jsView on unpkg · L20103if (asset.endsWith(".zip")) {
L104: // Windows only. PowerShell's Expand-Archive is always present and reliably
L105: // reads zips, unlike whatever `tar` happens to be on PATH.
High
dist/browserProvisioner.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @melaya/runner@1.0.93
matchedIdentity = npm:QG1lbGF5YS9ydW5uZXI:1.0.93
similarity = 0.538
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical6 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/browserProvisioner.js
HighChild Processdist/uvBootstrap.js
HighShelldist/uvBootstrap.js
HighSandbox Evasion Gated Capabilitydist/browserProvisioner.js
HighCloud Metadata Accessdist/browserAuthz.js
HighRuntime Package Installdist/lumaLogin.js
HighSemantic Analysis Limiteddist/linkedinLogin.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/localRagIngest.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @melaya/runner@1.1.33.
See all versions of @melaya/runner for other recorded verdicts.
- Review the evidence and your use of @melaya/runner@1.1.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.