@melaya/runner@1.1.73
Run Melaya AI pipelines locally with your own LM Studio or Ollama models
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe source shows an ordinary Luma login path transferring an active service session cookie to the package's default cloud recipient without recipient-specific consent. The login prompt does not disclose that transfer, so the behavior supports blocking.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The connected server sends a luma:start-login request, and the user completes sign-in in the opened browser.
Impact
The cloud recipient receives a cookie that can authenticate a Luma session.
Mechanism
The runner extracts the Luma authentication cookie, includes it in the login result, and emits that result over the authenticated socket to api.melaya.org.
Attack narrative
A cloud login request opens a visible Luma sign-in page. After sign-in, the runner captures the Luma session cookie and sends it in a socket event to the default Melaya cloud server. The prompt asks the user to sign in but does not disclose that the cookie will be forwarded to that separate recipient.
AI rationale
The source shows an ordinary Luma login path transferring an active service session cookie to the package's default cloud recipient without recipient-specific consent. The login prompt does not disclose that transfer, so the behavior supports blocking.
Evidence
package.jsondist/cli.jsdist/connection.jsdist/lumaLogin.js
Network endpoints2
luma.com/signinwss://api.melaya.org
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI defaults to api.melaya.org and connects to it with an authenticated socket.
- On a cloud login request, the runner opens Luma sign-in and captures the Luma session cookie.
- The login flow returns the cookie in its outcome, which the runner emits over the cloud socket.
- The visible prompt asks the user to sign in to Luma but does not disclose that the session cookie will be sent to Melaya.
- The manifest identifies the package as @melaya/runner version 1.1.73.
Evidence against
- The Luma login uses a visible browser and asks the user to sign in, consistent with an intended product feature.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/uvBootstrap.jsView file
20import { homedir, platform, arch } from "os";
L21: import { execFile } from "child_process";
L22: import { spawnTracked as spawn, registerSetupChild, terminateTree } from "./processTree.js";
High
Child Process
Package source references child process execution.
dist/uvBootstrap.jsView on unpkg · L20dist/lumaLogin.jsView file
52const child = spawn("npx", ["playwright", "install", "chromium"], {
L53: shell: true,
L54: stdio: ["ignore", "pipe", "pipe"],
High
51progress("Preparing browser for Luma sign-in (one-time setup, ~140 MB)…");
L52: const child = spawn("npx", ["playwright", "install", "chromium"], {
L53: shell: true,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
Findings
1 Critical6 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/browserProvisioner.js
HighChild Processdist/uvBootstrap.js
HighShelldist/lumaLogin.js
HighSandbox Evasion Gated Capabilitydist/browserProvisioner.js
HighCloud Metadata Accessdist/browserAuthz.js
HighRuntime Package Installdist/lumaLogin.js
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
MediumDynamic Requiredist/computerRelay.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build HelperlocalVault.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @melaya/runner@1.1.73.
See all versions of @melaya/runner for other recorded verdicts.
- Avoid installing @melaya/runner@1.1.73. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.