registry / @melaya/runner / 1.1.76
@melaya/runner@1.1.76
Run Melaya AI pipelines locally with your own LM Studio or Ollama models
AI Security Review
scanned 5h ago · by lpm-firewall-aiThe flagged credential flows query Anthropic and GitHub for their own provider features, while the CLI requires a user-supplied Melaya token. The package has no install hook; its failure telemetry is bounded and opt-out, and browser downloads require explicit authorization.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The user launches the CLI with a runner token; provider discovery also refreshes during an active runner session. Browser sign-in and browser downloads require a request or explicit authorization.
Impact
No unintended credential transfer, account action, install-time collection, or destructive behavior was identified.
Mechanism
Reads provider credentials to query the corresponding provider APIs for available models; failure telemetry goes to the configured Melaya server and has an opt-out. Metadata endpoints are handled by browser egress-blocking policy.
AI rationale
The flagged credential flows query Anthropic and GitHub for their own provider features, while the CLI requires a user-supplied Melaya token. The package has no install hook; its failure telemetry is bounded and opt-out, and browser downloads require explicit authorization.
Evidence
~/.claude/.credentials.json~/.config/github-copilot/apps.json~/.config/github-copilot/hosts.json~/.melaya-runner/github_copilot.json~/.melaya/luma/storage-state.json~/.melaya-runner/bin/uv
Network endpoints6
api.anthropic.comapi.github.comapi.githubcopilot.comapi.melaya.org127.0.0.1luma.com
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepublishOnly, which runs the build; there is no install hook.
- The CLI requires a user-provided Melaya runner token and starts provider discovery when the runner is launched.
- Claude credentials are read for model discovery and sent to api.anthropic.com, their own service.
- GitHub Copilot credentials are read for model discovery and sent to api.github.com for a Copilot token exchange.
- Failure reporting is limited to the Melaya service, requires a supplied runner token, and can be disabled with MELAYA_RUNNER_NO_TELEMETRY=1.
- Chromium download requires explicit authorization.
Evidence against
- Provider discovery reads local credential files, but the observed requests use the respective providers’ own API hosts.
- The failure report sends bounded operational fields rather than file contents, paths, usernames, hostnames, or error strings.
- The metadata addresses in the routing hint appear in browser network-blocking policy, not credential collection.
Behavioral surface
ChildProcess
Source & flagged code
20 flaggeddist/uvBootstrap.jsView file
20import { homedir, platform, arch } from "os";
L21: import { execFile } from "child_process";
L22: import { spawnTracked as spawn, registerSetupChild, terminateTree } from "./processTree.js";
High
Child Process
Package source references child process execution.
dist/uvBootstrap.jsView on unpkg · L20•matchType = normalized_sha256
matchedPackage = @melaya/runner@1.1.73
matchedPath = dist/uvBootstrap.js
matchedIdentity = npm:QG1lbGF5YS9ydW5uZXI:1.1.73
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/uvBootstrap.jsView on unpkgdist/lumaLogin.jsView file
52const child = spawn("npx", ["playwright", "install", "chromium"], {
L53: shell: true,
L54: stdio: ["ignore", "pipe", "pipe"],
Findings
18 High5 Medium5 Low
HighChild Processdist/uvBootstrap.js
HighShelldist/lumaLogin.js
HighSandbox Evasion Gated Capabilitydist/browserProvisioner.js
HighCloud Metadata Accessdist/browserAuthz.js
HighRuntime Package Installdist/lumaLogin.js
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/browserProvisioner.js
HighKnown Malware Source Similaritydist/codeWorker.js
HighKnown Malware Source Similaritydist/detect.js
HighKnown Malware Source Similaritydist/vaults.js
HighKnown Malware Source Similaritydist/cli.js
High
Affected versions and remediation
This report applies to @melaya/runner@1.1.76.
See all versions of @melaya/runner for other recorded verdicts.
- Review the evidence and your use of @melaya/runner@1.1.76 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.