@mastra/blaxel@0.10.1

Blaxel cloud sandbox provider for Mastra workspaces

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The published entrypoints and inspected runtime modules implement a Blaxel cloud sandbox adapter with user-invoked API and process operations. The SDK telemetry path is opt-in and no concrete attack behavior was found.

Static reason

No blocking static signals were detected.

Trigger

Consumers invoke the exported workspace and sandbox APIs; SDK telemetry is attempted during SDK initialization.

Impact

No unconsented credential transfer, install-time mutation, or other malicious effect was identified in the inspected source.

Mechanism

The package delegates API, sandbox, process, and MCP operations to @blaxel/core. PostHog requires tracking to be enabled and an API key to be present; tracking defaults off, and Sentry also checks the tracking setting.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json selects the published dist entrypoints, declares @blaxel/core as its runtime dependency, and lists build, test, and lint scripts. The inspected dependency manifest identifies the Blaxel core SDK and its runtime entrypoints.
The required runtime modules implement Blaxel authentication, API clients, sandbox resources and process operations, jobs, images, and MCP adapters. The package entrypoint imports the SDK, validates configured endpoint protocols, and quotes arguments passed to sandbox commands.
The SDK telemetry path is gated: tracking defaults off, PostHog requires both a key and enabled tracking, and Sentry also checks the tracking setting. The install event identifies the SDK and version and uses a persisted distinct identifier.
The inspected modules provide generated Blaxel control-plane and sandbox clients; control-plane requests are rebased to the configured API base and authenticated through SDK settings, while transport uses fetch or the HTTP/2 pool. The other modules handle authentication error responses, deferred initialization, local cache reads, and generated API exports.
The application and sandbox modules call resource APIs and configure sandbox transport; authentication modules expose API-key bearer authorization and obtain client-credentials tokens through oauthToken.

Source & flagged code

9 flagged

dist/index.jsView file

Lines 39-79javascript

39/**

40* Validate and normalize a mount prefix before interpolating into shell commands.

41* Returns the normalized prefix (no leading/trailing slashes).

42*

43* Shell safety is handled by shellQuote() at the call site, so this function

44* only enforces path-level rules (no traversal, no empty result, no control chars).

45*/

46function validatePrefix(prefix) {

47 let normalized = prefix;

48 while (normalized.startsWith("/")) normalized = normalized.slice(1);

49 while (normalized.endsWith("/")) normalized = normalized.slice(0, -1);

50 if (!normalized) throw new Error("Mount prefix cannot be empty after normalization.");

51 if (normalized.includes("//") || normalized.split("/").some((s) => s === "." || s === "..")) throw new Error(`Invalid mount prefix: "${

52 if (/[\x00-\x1f\x7f]/.test(normalized)) throw new Error(`Invalid mount prefix: "${prefix}". Control characters are not allowed.`);

53 return normalized;

54}

55/**

56* Detect the system package manager available in the sandbox.

57* Returns 'apt' for Debian/Ubuntu, 'apk' for Alpine, or 'unknown'.

58*/

59async function detectPackageManager(sandbox) {

60 const pm = (await runCommand(sandbox, "which apt-get >/dev/null 2>&1 && echo \"apt\" || (which apk >/dev/null 2>&1 && echo \"apk\" || echo \"unknown\")")).stdout.trim();

61 if (pm === "apt") return "apt";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L59

62 if (pm === "apk") return "apk";

63 return "unknown";

64}

65/**

66* Run a command in the Blaxel sandbox and return the result.

67* Wraps the process.exec API to match the command execution pattern used in mount operations.

68*

69* Does NOT throw on non-zero exit codes — callers should check `exitCode` themselves.

70*/

71async function runCommand(sandbox, command, options) {

72 const result = await sandbox.process.exec({

73 command,

74 waitForCompletion: true,

75 ...options?.timeout && { timeout: Math.ceil(options.timeout / 1e3) }

76 });

77 return {

78 exitCode: result.exitCode ?? 0,

79 stdout: result.stdout ?? "",

package.jsonView file

Lines 38-69json

38 "@mastra/s3": "0.6.4"

39 },

40 "peerDependencies": {

41 "@mastra/core": ">=1.12.0-0 <2.0.0-0"

42 },

43 "files": [

44 "dist"

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/authentication/credentials.jsView file

4const env_js_1 = require("../common/env.js"); class Credentials { async authenticate() { } get workspace() { return env_js_1.env.BL_WORKSPACE || ""; }

Low

Ai Review Evidence

The required runtime modules implement Blaxel authentication, API clients, sandbox resources and process operations, jobs, images, and MCP adapters. The package entrypoint imports the SDK, validates configured endpoint protocols, and quotes arguments passed to sandbox commands.

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/authentication/credentials.jsView on unpkg · L4

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/authentication/index.jsView file

13const deviceMode_js_1 = require("./deviceMode.js"); function getCredentials() { if (env_js_1.env.BL_API_KEY) { return { apiKey: env_js_1.env.BL_AP

Low

Ai Review Evidence

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/authentication/index.jsView on unpkg · L13

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/image/image.jsView file

4}; Object.defineProperty(exports, "__esModule", { value: true }); exports.ImageInstance = exports.SANDBOX_API_PATH = exports.SANDBOX_API_IMAGE = void 0; const index_js_1

Low

Ai Review Evidence

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/image/image.jsView on unpkg · L4

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/jobs/jobs.jsView file

4const index_js_1 = require("../client/index.js"); const logger_js_1 = require("../common/logger.js"); const pagination_js_1 = require("../common/pagination.js"); const se

Low

Ai Review Evidence

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/jobs/jobs.jsView on unpkg · L4

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/jobs/start.jsView file

4const autoload_js_1 = require("../common/autoload.js"); const env_js_1 = require("../common/env.js"); const telemetry_js_1 = require("../telemetry/telemetry.js"); class B

Low

Ai Review Evidence

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/jobs/start.jsView on unpkg · L4

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/jobs/types.jsView file

1"use strict"; Object.defineProperty(exports, "__esModule", { value: true });

Low

Ai Review Evidence

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/jobs/types.jsView on unpkg · L1

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/mcp/client.jsView file

4const types_js_1 = require("@modelcontextprotocol/sdk/types.js"); const logger_js_1 = require("../common/logger.js"); const node_js_1 = require("../common/node.js"); cons

Low

Ai Review Evidence

.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/mcp/client.jsView on unpkg · L4

Source & flagged code

9 flagged · loading source

dist/index.jsView file

59async function detectPackageManager(sandbox) { L60: const pm = (await runCommand(sandbox, "which apt-get >/dev/null 2>&1 && echo \"apt\" || (which apk >/dev/null 2>&1 && echo \"apk\" || echo \"unknown\")")).stdout.trim(); L61: if (pm === "apt") return "apt"; ... L126: await runCommand(sandbox, `rm -f ${credentialsPath}`); L127: await sandbox.fs.write(credentialsPath, credentialsContent); L128: await runCommand(sandbox, `chmod 600 ${credentialsPath}`); ... L181: if (prepResult.exitCode !== 0) throw new Error(`Failed to install gcsfuse prerequisites.\nError details: ${prepResult.stderr || prepResult.stdout}`); L182: const installResult = await runCommand(sandbox, `curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /etc/apt/keyrings/gcsfuse.gpg && echo "d

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L59

package.jsonView file

58"scripts": { "build": "tsdown --silent --config tsdown.config.ts", "build:lib": "pnpm build", "build:watch": "pnpm build --watch", "test:unit": "vitest run --exclude '**/*.integration.test.ts'", "test:watch":

Low

Suspicious Dependency Evidence

package.json selects the published dist entrypoints, declares @blaxel/core as its runtime dependency, and lists build, test, and lint scripts. The inspected dependency manifest identifies the Blaxel core SDK and its runtime entrypoints.

Findings

1 Medium11 Low

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/index.js

LowUrl Strings

LowSuspicious Dependency Evidencepackage.json

LowAi Review Evidence.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/authentication/credentials.js

LowAi Review Evidence.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/authentication/index.js

LowAi Review Evidence.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/image/image.js

LowAi Review Evidence.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/jobs/jobs.js

LowAi Review Evidence.lpm-dependency-evidence-38c6722e-d029-4df3-83bb-7e15af96e8b2/0/npm-linux/dist/cjs/jobs/start.js

Affected versions and remediation

This report applies to @mastra/blaxel@0.10.1.

See all versions of @mastra/blaxel for other recorded verdicts.

Review the evidence and your use of @mastra/blaxel@0.10.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 12:02:19.378Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code