@melaya/runner@1.1.49
Run Melaya AI pipelines locally with your own LM Studio or Ollama models
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a real server-controlled local execution channel and captures reusable third-party browser credentials. Static source does not show covert install-time execution or an independently malicious payload, so this is a dangerous capability rather than confirmed malware.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An operator runs the CLI with a runner token and the connected service dispatches a pipeline or login request.
Impact
A compromised or malicious configured service could execute arbitrary Python and receive third-party session credentials from the runner host.
Mechanism
Server-delivered code execution and authenticated browser-session collection.
AI rationale
The package contains a real server-controlled local execution channel and captures reusable third-party browser credentials. Static source does not show covert install-time execution or an independently malicious payload, so this is a dangerous capability rather than confirmed malware.
Evidence
dist/connection.jsdist/sharedVendor.jsdist/lumaLogin.js~/.melaya-runner/shared/main.pyconfig.json~/.melaya/luma/storage-state.json
Network endpoints2
api.melaya.org/api/v1/runner/shared-bundle
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- A connected server can supply Python source that the runner writes and executes locally.
- The package fetches a server bundle and writes every accepted file into its cache.
- The Luma flow saves full browser session state and sends captured authentication cookies back over the socket.
Evidence against
- There is no install, preinstall, or postinstall hook; only prepublishOnly is declared.
- Execution requires an operator to start the CLI with a runner token and connect to its configured service.
- The browser authorization code explicitly denies cloud metadata and private-network destinations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/uvBootstrap.jsView file
20import { homedir, platform, arch } from "os";
L21: import { spawn, execSync } from "child_process";
L22: const CACHE_DIR = join(homedir(), ".melaya-runner");
High
Child Process
Package source references child process execution.
dist/uvBootstrap.jsView on unpkg · L20103if (asset.endsWith(".zip")) {
L104: // Windows only. PowerShell's Expand-Archive is always present and reliably
L105: // reads zips, unlike whatever `tar` happens to be on PATH.
High
dist/browserProvisioner.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @melaya/runner@1.0.93
matchedIdentity = npm:QG1lbGF5YS9ydW5uZXI:1.0.93
similarity = 0.538
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical6 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/browserProvisioner.js
HighChild Processdist/uvBootstrap.js
HighShelldist/uvBootstrap.js
HighSandbox Evasion Gated Capabilitydist/browserProvisioner.js
HighCloud Metadata Accessdist/browserAuthz.js
HighRuntime Package Installdist/lumaLogin.js
HighSemantic Analysis Limiteddist/linkedinLogin.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build HelperlocalDbProbe.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @melaya/runner@1.1.49.
See all versions of @melaya/runner for other recorded verdicts.
- Review the evidence and your use of @melaya/runner@1.1.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.