registry / @melaya/runner / 1.1.69
@melaya/runner@1.1.69
⚠ Under reviewRun Melaya AI pipelines locally with your own LM Studio or Ollama models
Static Scan Results
scanned 14d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/uvBootstrap.jsView file
20import { homedir, platform, arch } from "os";
L21: import { execFile } from "child_process";
L22: import { spawnTracked as spawn, registerSetupChild, terminateTree } from "./processTree.js";
High
Child Process
Package source references child process execution.
dist/uvBootstrap.jsView on unpkg · L20dist/lumaLogin.jsView file
52const child = spawn("npx", ["playwright", "install", "chromium"], {
L53: shell: true,
L54: stdio: ["ignore", "pipe", "pipe"],
High
51progress("Preparing browser for Luma sign-in (one-time setup, ~140 MB)…");
L52: const child = spawn("npx", ["playwright", "install", "chromium"], {
L53: shell: true,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
Findings
6 High5 Medium5 Low
HighChild Processdist/uvBootstrap.js
HighShelldist/lumaLogin.js
HighSandbox Evasion Gated Capabilitydist/browserProvisioner.js
HighCloud Metadata Accessdist/browserAuthz.js
HighRuntime Package Installdist/lumaLogin.js
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
MediumDynamic Requiredist/computerRelay.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build HelperlocalVault.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @melaya/runner@1.1.69.
See all versions of @melaya/runner for other recorded verdicts.
- Review the evidence and your use of @melaya/runner@1.1.69 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.