registry / @mastra/code-sdk / 1.7.2
@mastra/code-sdk@1.7.2
⚠ Under reviewMastra Code SDK: the agent core behind Mastra Code (everything except the TUI) — build your own UIs and surfaces on top of it
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/plugins/loader.jsView file
115url.searchParams.set("size", stat.size.toString());
L116: const mod = await import(url.href);
L117: return validatePluginExport(mod.default ?? mod.plugin);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/plugins/loader.jsView on unpkg · L115dist/index.jsView file
173return {
L174: accessToken: process.env.MASTRA_CLOUD_ACCESS_TOKEN,
L175: projectId: process.env.MASTRA_PROJECT_ID
...
L212: async function createMastraCodeAgentController(config) {
L213: const cwd = config?.cwd ?? process.cwd();
L214: const homeDir = config?.homeDir ?? config?.initialState?.homeDir;
...
L248: const mastraCodeGateway = createMastraCodeGateway({
L249: mastraGatewayBaseUrl: (process.env["MASTRA_GATEWAY_URL"] ?? storedGatewayUrl ?? "https://gateway-api.mastra.ai").replace(/\/+$/, "").replace(/\/v1$/, ""),
L250: mastraGatewayApiKey: mgApiKey,
...
L261: const sessionId = `mastracode-session-${shortHash(project.resourceId)}`;
L262: const ownerId = `mastracode-${shortHash(`${hostname()}\0${project.rootPath}`)}`;
L263: const configuredPubSub = config?.pubsub;
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
Findings
3 High4 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/index.js
HighSemantic Analysis Limitedpackage.json
HighPrevious Version Dangerous Deltadist/onboarding/settings.js
MediumDynamic Requiredist/plugins/loader.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/code-sdk@1.7.2.
See all versions of @mastra/code-sdk for other recorded verdicts.
- Review the evidence and your use of @mastra/code-sdk@1.7.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.