registry / @mastra/auth-clerk / 1.3.1

@mastra/auth-clerk@1.3.1

⚠ Under review

Mastra Clerk Auth integration

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The inspected source implements Clerk authentication and showed no concrete attack behavior. The declared @clerk/backend dependency is used at runtime but its source was unavailable in the prepared snapshot, so the review remains unresolved.

Static reason

No blocking static signals were detected.

Trigger

Loading the package imports the backend client; constructing the provider configures it with caller-provided or environment credentials.

Impact

The unresolved dependency prevents a complete assessment of the package's runtime behavior; no specific harmful effect was established.

Mechanism

The provider uses the client for Clerk authentication operations, but the backend client's own implementation could not be assessed.

AI rationale

Evidence

package.jsondist/index.jsdist/index.cjs.lpm-dependency-evidence-9097c764-3ee2-4b97-a925-d9d87746abdc/1/npm-linux/package.json.lpm-dependency-evidence-9097c764-3ee2-4b97-a925-d9d87746abdc/1/npm-linux/dist/index.js.lpm-dependency-evidence-9097c764-3ee2-4b97-a925-d9d87746abdc/1/npm-linux/dist/index.cjs

Decision evidence

public snapshot

AI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares no install lifecycle hook and imports the built library from its published entrypoints.
The provider uses configured Clerk credentials and the Clerk client; its OAuth token exchange goes to a URL derived from the Clerk publishable key.
The declared Clerk backend dependency is imported and used, but its implementation is absent from the inspected snapshot, leaving its behavior unresolved.

Evidence against

Inspected code showed no credential transfer to an unrelated recipient or automatic account changes.
The prepared @mastra/auth dependency verifies JWTs using the configured JWKS URI.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 54.0 KB of source

Source & flagged code

8 flagged

dist/index.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cjs#virtual:normalized:round1View on unpkg

package.jsonView file

Lines 3-59json

3 "version": "1.3.1",

4 "description": "Mastra Clerk Auth integration",

5 "type": "module",

6 "main": "dist/index.js",

7 "types": "dist/index.d.ts",

8 "exports": {

9 ".": {

10 "import": {

11 "types": "./dist/index.d.ts",

12 "default": "./dist/index.js"

13 },

14 "require": {

15 "types": "./dist/index.d.ts",

16 "default": "./dist/index.cjs"

17 }

18 },

19 "./package.json": "./package.json"

20 },

21 "license": "Apache-2.0",

22 "dependencies": {

23 "@clerk/backend": "^3.17.2",

24 "@mastra/auth": "1.1.4"

25 },

26 "devDependencies": {

27 "@types/node": "22.20.1",

28 "@vitest/coverage-v8": "4.1.11",

29 "@vitest/ui": "4.1.11",

Low

Suspicious Dependency Evidence

The declared Clerk backend dependency is imported and used, but its implementation is absent from the inspected snapshot, leaving its behavior unresolved.

package.jsonView on unpkg · L23

30 "tsdown": "0.22.9",

31 "typescript": "^7.0.2",

32 "vitest": "4.1.11",

33 "@internal/auth": "0.0.34",

34 "@internal/lint": "0.0.145",

35 "@internal/types-builder": "0.0.120"

36 },

37 "files": [

38 "dist"

39 ],

40 "homepage": "https://mastra.ai",

41 "repository": {

42 "type": "git",

43 "url": "git+https://github.com/mastra-ai/mastra.git",

44 "directory": "auth/clerk"

45 },

46 "bugs": {

47 "url": "https://github.com/mastra-ai/mastra/issues"

48 },

49 "engines": {

50 "node": ">=22.13.0"

51 },

52 "scripts": {

53 "build": "tsdown --silent --config tsdown.config.ts",

54 "build:watch": "tsdown --watch --silent --config tsdown.config.ts",

55 "test": "vitest run",

56 "lint": "oxlint --type-aware .",

57 "lint:fix": "oxlint --type-aware --fix ."

58 }

59}

Low

Suspicious Lifecycle Evidence

The manifest declares no install lifecycle hook and imports the built library from its published entrypoints.

package.jsonView on unpkg · L52

dist/index.jsView file

Lines 1-21javascript

1import { createClerkClient } from "@clerk/backend";

2import { verifyJwks } from "@mastra/auth";

3//#region ../../packages/_internals/auth/dist/types/index.js

4function headerFromPlainObject(headers, name) {

Low

Suspicious Dependency Evidence

dist/index.cjsView file

Lines 1-22javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

2let _clerk_backend = require("@clerk/backend");

3let _mastra_auth = require("@mastra/auth");

4//#region ../../packages/_internals/auth/dist/types/index.js

.lpm-dependency-evidence-9097c764-3ee2-4b97-a925-d9d87746abdc/1/npm-linux/package.jsonView file

26"dependencies": { "jsonwebtoken": "^9.0.3", "jwks-rsa": "^3.2.2" }, "devDependencies": { "@types/jsonwebtoken": "^9.0.10", "@types/node": "22.20.1", "@vites

Low

Suspicious Lifecycle Evidence

The manifest declares no install lifecycle hook and imports the built library from its published entrypoints.

.lpm-dependency-evidence-9097c764-3ee2-4b97-a925-d9d87746abdc/1/npm-linux/package.jsonView on unpkg · L26

Source & flagged code

8 flagged · loading source

dist/index.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cjs#virtual:normalized:round1View on unpkg

package.jsonView file

52"scripts": { "build": "tsdown --silent --config tsdown.config.ts", "build:watch": "tsdown --watch --silent --config tsdown.config.ts", "test": "vitest run", "lint": "oxlint --type-aware .", "lint:fix": "oxlint --type-aware --fix ." } }

Low

Suspicious Lifecycle Evidence

The manifest declares no install lifecycle hook and imports the built library from its published entrypoints.

package.jsonView on unpkg · L52

23"@clerk/backend": "^3.17.2", "@mastra/auth": "1.1.4" }, "devDependencies": { "@types/node": "22.20.1", "@vitest/coverage-v8": "4.1.11", "@vitest/ui": "4.1.11",

Findings

1 High2 Medium9 Low

HighSemantic Analysis Limiteddist/index.cjs#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidencedist/index.js

LowAi Review Evidencedist/index.js

LowSuspicious Dependency Evidencedist/index.cjs

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-9097c764-3ee2-4b97-a925-d9d87746abdc/1/npm-linux/package.json

Affected versions and remediation

This report applies to @mastra/auth-clerk@1.3.1.

See all versions of @mastra/auth-clerk for other recorded verdicts.

Review the evidence and your use of @mastra/auth-clerk@1.3.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 12:11:36.530Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code