registry / @mastra/auth / 1.1.1

@mastra/auth@1.1.1

AI Security Review

scanned 18m ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime behavior is limited to JWT verification and optional caller-supplied JWKS retrieval.

Static reason

No blocking static signals were detected.

Trigger

Application imports the package and calls its exported authentication helpers.

Impact

No credential harvesting, exfiltration, persistence, or destructive behavior established.

Mechanism

Local JWT verification with optional caller-configured JWKS lookup.

Rationale

Source inspection shows a conventional authentication library with no install-time execution or concrete malicious behavior. The environment-variable reference is a local JWT secret fallback, not collection or transmission.

Evidence

package.jsondist/index.jsdist/index.cjsdist/index.js.mapdist/docs/SKILL.mddist/docs/references/docs-server-auth-custom-auth-provider.mddist/docs/references/docs-server-auth-jwt.md

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks or bin entrypoints.
dist/index.js only imports jsonwebtoken and jwks-rsa and exports JWT authentication helpers.
JWT_AUTH_SECRET is read only when MastraJwtAuth is constructed; it is used locally for jwt.verify.
JWKS access is only invoked by explicit verifyJwks(accessToken, jwksUri) calls; no endpoint is hard-coded.
No filesystem, shell, eval, persistence, or agent-control-surface operations found in executable files.

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 16.1 KB of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

1 Medium1 Low

MediumEnvironment Vars

LowScripts Present