@melaya/runner@1.1.44
Run Melaya AI pipelines locally with your own LM Studio or Ollama models
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe source confirms an interactive Luma login followed by transmission of its session cookie to the configured server, whose default is the package’s Melaya endpoint. The flow does not obtain recipient-specific consent for that transfer, supporting a malicious credential-exfiltration verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The connected server sends a luma:start-login event, which starts the interactive Luma sign-in flow.
Impact
The receiving server obtains a Luma session credential that can authorize actions as the signed-in user.
Mechanism
The runner reads the Luma session cookie from the browser context, returns it in the login result, and emits that result over its authenticated socket.
Attack narrative
When a Luma login is requested, the runner opens an interactive Luma sign-in window, captures the resulting session cookie, and sends it in a socket event to its configured server. The CLI’s default server is api.melaya.org. The inspected sign-in prompt asks the user to authenticate to Luma but does not identify the server that receives the cookie, so this is an unconsented disclosure of a third-party session credential.
AI rationale
The source confirms an interactive Luma login followed by transmission of its session cookie to the configured server, whose default is the package’s Melaya endpoint. The flow does not obtain recipient-specific consent for that transfer, supporting a malicious credential-exfiltration verdict.
Evidence
dist/cli.jsdist/connection.jsdist/lumaLogin.js
Network endpoints2
luma.com/signinwss://api.melaya.org
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI defaults its server destination to api.melaya.org.
- The runner authenticates its socket to the configured server with the runner token.
- The Luma flow opens Luma sign-in and asks the user to sign in.
- After sign-in, the flow reads the Luma session cookie.
- The flow returns that cookie in its login result.
- The connection handler sends the login result to the server over the socket.
Evidence against
- The transfer follows an interactive Luma sign-in request; the inspected flow does not show a prompt naming the server that will receive the cookie.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/uvBootstrap.jsView file
20import { homedir, platform, arch } from "os";
L21: import { spawn, execSync } from "child_process";
L22: const CACHE_DIR = join(homedir(), ".melaya-runner");
High
Child Process
Package source references child process execution.
dist/uvBootstrap.jsView on unpkg · L20103if (asset.endsWith(".zip")) {
L104: // Windows only. PowerShell's Expand-Archive is always present and reliably
L105: // reads zips, unlike whatever `tar` happens to be on PATH.
High
dist/browserProvisioner.jsView file
17import { existsSync, readdirSync } from "node:fs";
L18: import { execFile } from "node:child_process";
L19: import { join } from "node:path";
...
L29: function windowsCandidates() {
L30: const pf = process.env["ProgramFiles"] || "C:\\Program Files";
L31: const pf86 = process.env["ProgramFiles(x86)"] || "C:\\Program Files (x86)";
L32: const local = process.env["LOCALAPPDATA"] || join(os.homedir(), "AppData", "Local");
L33: return [
...
L88: async function detectVersion(exePath) {
L89: if (process.platform === "win32") {
L90: try {
...
L128: // Fallback: run the binary with --version. Some Chromium builds print
Findings
1 Critical6 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/connection.js
HighChild Processdist/uvBootstrap.js
HighShelldist/uvBootstrap.js
HighSandbox Evasion Gated Capabilitydist/browserProvisioner.js
HighCloud Metadata Accessdist/browserAuthz.js
HighRuntime Package Installdist/lumaLogin.js
HighSemantic Analysis Limiteddist/linkedinLogin.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build HelperlocalDbProbe.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @melaya/runner@1.1.44.
See all versions of @melaya/runner for other recorded verdicts.
- Avoid installing @melaya/runner@1.1.44. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.