@mastra/code-sdk@1.17.0
Mastra Code SDK: the agent core behind Mastra Code (everything except the TUI) — build your own UIs and surfaces on top of it
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe analytics helper includes the machine hostname in telemetry and defaults to enabled without an explicit consent step. Since the package entry point does not invoke it automatically, this is a warning-level telemetry concern rather than a block-worthy attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer creates the analytics helper and captures an event; telemetry is enabled by default unless disabled through an environment variable.
Impact
Exposes the machine hostname to the analytics service. The helper is not invoked by the inspected package entry point.
Mechanism
The helper adds `os.hostname()` as `machineId` to telemetry properties sent to `https://us.posthog.com`.
AI rationale
The analytics helper includes the machine hostname in telemetry and defaults to enabled without an explicit consent step. Since the package entry point does not invoke it automatically, this is a warning-level telemetry concern rather than a block-worthy attack.
Evidence
dist/analytics.jsdist/platform/index.js
Network endpoints2
us.posthog.complatform.mastra.ai
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The analytics helper sends the machine hostname as `machineId` alongside runtime and platform details.
- The analytics factory is enabled unless `MASTRA_TELEMETRY_DISABLED` is set to a truthy value; it does not request user consent.
- The package entry point is `dist/index.js`; the inspected entry-point code does not call the analytics helper.
- Platform credentials are sent to the Mastra Platform API for token verification and refresh.
- The VM call is limited to forcing garbage collection during an explicit vacuum operation.
Evidence against
- The analytics code is a helper factory, not an import-time PostHog client or automatic capture.
- The analytics helper reports recognizable runtime and platform fields with a random distinct ID, but also includes the hostname.
- Platform credential handling targets Mastra’s own platform endpoint, and browser login is an explicit operation.
- Plugin code is dynamically imported only for enabled plugin records.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
6 flaggeddist/platform/index.jsView file
1import { join } from "path";
L2: import { execFile } from "child_process";
L3: import { homedir } from "os";
High
Child Process
Package source references child process execution.
dist/platform/index.jsView on unpkg · L11import { join } from "path";
L2: import { execFile } from "child_process";
L3: import { homedir } from "os";
L4: import { chmod, mkdir, readFile, writeFile } from "fs/promises";
L5: import { createServer } from "http";
L6: // src/platform/index.ts
...
L13: */
L14: const MASTRA_PLATFORM_API_URL = process.env.MASTRA_PLATFORM_API_URL || "https://platform.mastra.ai";
L15: const CREDENTIALS_DIR = join(homedir(), ".mastra");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/platform/index.jsView on unpkg · L1•matchType = previous_version_dangerous_delta
matchedPackage = @mastra/code-sdk@1.14.0
matchedIdentity = npm:QG1hc3RyYS9jb2RlLXNkaw:1.14.0
similarity = 0.533
summary = stored previous version shares package body but lacks this dangerous source file
High
Findings
5 High5 Medium6 Low
HighChild Processdist/platform/index.js
HighShell
HighSame File Env Network Executiondist/platform/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighPrevious Version Dangerous Deltadist/platform/index.js
MediumDynamic Requiredist/plugins/loader.js
MediumUnsafe Vm Contextdist/utils/storage-maintenance.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Affected versions and remediation
This report applies to @mastra/code-sdk@1.17.0.
See all versions of @mastra/code-sdk for other recorded verdicts.
- Review the evidence and your use of @mastra/code-sdk@1.17.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.