registry / @mastra/code-sdk / 1.5.0
@mastra/code-sdk@1.5.0
Mastra Code SDK: the agent core behind Mastra Code (everything except the TUI) — build your own UIs and surfaces on top of it
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis release is the Mastra Code agent SDK with ordinary build scripts and no npm lifecycle hooks. File writes, shell use, and PostHog telemetry are caller-invoked product features rather than a hidden install attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No automatic install or import trigger. Agent tools and settings writes run only when application code calls them.
Impact
No unconsented credential theft, remote payload execution, persistence, or foreign agent-control mutation was found.
Mechanism
Lifecycle scripts are absent. Settings are written to the package app-data settings file, and telemetry is optional product analytics to PostHog.
AI rationale
This release is the Mastra Code agent SDK with ordinary build scripts and no npm lifecycle hooks. File writes, shell use, and PostHog telemetry are caller-invoked product features rather than a hidden install attack.
Network endpoints1
us.posthog.com
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hooks; scripts are only build, typecheck, test, and lint.
- dist/index.js is a library entry that imports the Mastra coding-agent SDK and related local modules, with no install-time side effect.
- saveSettings writes JSON under the package settings path returned by getSettingsPath, which joins the app data directory and settings.json.
- Product telemetry posts usage metadata to us.posthog.com and is turned off when MASTRA_TELEMETRY_DISABLED is set.
Evidence against
- Shell spawn, git, clipboard, LSP, and hook execution exist for coding-agent features and are not tied to an npm lifecycle script.
- The package does not depend on its own name and does not mutate foreign agent control files at install time.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
4 flaggeddist/plugins/loader.jsView file
115url.searchParams.set("size", stat.size.toString());
L116: const mod = await import(url.href);
L117: return validatePluginExport(mod.default ?? mod.plugin);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/plugins/loader.jsView on unpkg · L115dist/index.jsView file
164return {
L165: accessToken: process.env.MASTRA_CLOUD_ACCESS_TOKEN,
L166: projectId: process.env.MASTRA_PROJECT_ID
...
L203: async function createMastraCodeAgentController(config) {
L204: const cwd = config?.cwd ?? process.cwd();
L205: const homeDir = config?.homeDir ?? config?.initialState?.homeDir;
...
L239: const mastraCodeGateway = createMastraCodeGateway({
L240: mastraGatewayBaseUrl: (process.env["MASTRA_GATEWAY_URL"] ?? storedGatewayUrl ?? "https://gateway-api.mastra.ai").replace(/\/+$/, "").replace(/\/v1$/, ""),
L241: mastraGatewayApiKey: mgApiKey,
...
L252: const sessionId = `mastracode-session-${shortHash(project.resourceId)}`;
L253: const ownerId = `mastracode-${shortHash(`${hostname()}\0${project.rootPath}`)}`;
L254: const configuredPubSub = config?.pubsub;
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
Findings
2 High4 Medium6 Low
HighSandbox Evasion Gated Capabilitydist/index.js
HighPrevious Version Dangerous Deltadist/onboarding/settings.js
MediumDynamic Requiredist/plugins/loader.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @mastra/code-sdk@1.5.0.
See all versions of @mastra/code-sdk for other recorded verdicts.
- Review the evidence and your use of @mastra/code-sdk@1.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.