Passed — safe to install
No malicious behavior detected. 21 low-signal pattern(s) reviewed.
scanned 17d ago · by lpm-firewall-ai
The package exposes agent framework capabilities, including sandbox command execution and workspace filesystem tools. These are runtime APIs for Mastra agents rather than install-time or import-time behavior, and no confirmed malicious delivery path was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Explicit runtime use of Mastra workspace/coding-agent APIs with configured sandbox/filesystem/tools
Impact
Can execute commands or modify files only when the consuming application wires those capabilities into an agent workspace; no unconsented package install/import action identified.
Mechanism
caller-configured agent workspace command and file tools
Rationale
Static inspection shows powerful but package-aligned AI agent/workspace primitives and no lifecycle hook, hardcoded exfiltration endpoint, persistence, or unconsented foreign agent control-surface mutation. The scanner's command/file/network findings map to documented runtime framework APIs that require explicit consumer configuration.
Evidence
package.json dist/chunk-A77V6K33.js dist/relevance/index.cjs dist/index.js dist/index.cjs
public snapshot AI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for block
dist/chunk-A77V6K33.js contains user-exposed workspace tools for shell execution and file writes/deletes LocalFilesystem supports contained:false, allowing host filesystem access when explicitly configured Evidence against
package.json has no preinstall/install/postinstall/prepare lifecycle hooks No source evidence of install-time mutation of Claude/Codex/Cursor/MCP config or agent control surfaces Dangerous primitives are exported runtime agent/workspace APIs gated by caller-provided workspace, sandbox, filesystem, and tool configuration Filesystem write/delete tools check readOnly/permissions; local filesystem defaults to contained:true Remote HTTP worker uses caller-provided serverUrl and MASTRA_WORKER_AUTH_TOKEN for Mastra workflow execution, not hardcoded exfiltration No hardcoded attacker endpoints or credential harvesting flow found in inspected hot files Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem
13 flagged · loading source • matchType = previous_version_dangerous_delta
matchedPackage = @mastra/core@1.48.0
matchedIdentity = npm:QG1hc3RyYS9jb3Jl:1.48.0
similarity = 0.842
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-A77V6K33.js View on unpkg 63 import { createRequire } from 'module';
L64: import { execFileSync } from 'child_process';
L65: import { StringDecoder } from 'string_decoder';
High Child Process
Package source references child process execution.
dist/chunk-A77V6K33.js View on unpkg · L63 41835 L41836: // src/workspace/sandbox/execa.ts
L41837: var cached2;
1 Critical 5 High 10 Medium 5 Low
Critical Previous Version Dangerous Delta dist/chunk-A77V6K33.js
High Child Process dist/chunk-A77V6K33.js
High Shell dist/chunk-A77V6K33.js
High Remote Agent Bridge dist/chunk-A77V6K33.js
High Cross File Remote Execution Context dist/chunk-A77V6K33.js
High Oversized Source File dist/chunk-QMAX6QL4.cjs
Medium Dynamic Require dist/relevance/index.cjs
Medium Network
Medium Environment Vars
Medium Structural Risk Force Deep Review
Medium Secret Pattern dist/docs/references/reference-storage-clickhouse.md
Medium Secret Pattern dist/docs/references/reference-storage-postgresql.md
NativeBindings
Network
Shell
WebSocket
Supply chain HighEntropyStrings Minified Telemetry UrlStrings
Manifest No manifest risk signals triggered.
scanned 311 file(s), 12.9 MB of source, external domains: 127.0.0.1, abacus.ai, ai-gateway.helicone.ai, ai-gateway.vercel.sh, ai-sdk.dev, ai.google.dev, ai.routing.sh, alipaytbox.yuque.com, ambient.xyz, api-docs.deepseek.com, api-inference.modelscope.cn, api-sherlock.cloudferro.com, api.302.ai, api.abliteration.ai, api.ambient.xyz, api.anthropic.com, api.anyapi.ai, api.auriko.ai, api.berget.ai, api.cerebras.ai, api.clarifai.com, api.claudin.io, api.cloudflare.com, api.code.umans.ai, api.cortecs.ai, api.deepinfra.com, api.deepseek.com, api.dinference.com, api.fireworks.ai, api.friendli.ai, api.getlilac.com, api.gmi-serving.com, api.groq.com, api.hpc-ai.com, api.inceptionlabs.ai, api.inceptron.io, api.inference.wandb.ai, api.intelligence.io.solutions, api.jiekou.ai, api.kilo.ai, api.kimi.com, api.lkeap.cloud.tencent.com, api.llama.com, api.llmgateway.io, api.lucidquery.com, api.meganova.ai, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai
Oversized source lightweight scan
dist/chunk-QMAX6QL4.cjs 2.04 MB file, sampled 256 KB
Filesystem ChildProcess EnvironmentVars Crypto HighEntropyStrings UrlStrings json-schema.org mastra.ai
63
import { createRequire } from 'module';
L64: import { execFileSync } from 'child_process';
L65: import { StringDecoder } from 'string_decoder';
...
L4283: });
L4284: this.readFile = options.readFile ?? ((path7) => readFileSync(path7, "utf-8"));
L4285: this.getIgnoredInstructionPaths = options.getIgnoredInstructionPaths;
...
L4501: Rules:
L4502: - Call the available tools via the \`external_*\` functions declared below. Each
L4503: returns a Promise \u2014 \`await\` it.
...
L35048: var HttpRemoteStrategy = class _HttpRemoteStrategy {
L35049: #baseUrl;
L35050: #auth;
High Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/chunk-A77V6K33.js View on unpkg · L63 63 Cross-file remote execution chain: dist/chunk-A77V6K33.js spawns dist/chunk-25T7U65K.js; helper contains network access plus dynamic code execution.
L63: import { createRequire } from 'module';
L64: import { execFileSync } from 'child_process';
L65: import { StringDecoder } from 'string_decoder';
...
L187: if (sdkTool.inputSchema) {
L188: if ("$schema" in sdkTool.inputSchema && typeof sdkTool.inputSchema.$schema === "string" && sdkTool.inputSchema.$schema.startsWith("http://json-schema.org/")) {
L189: parameters = sdkTool.inputSchema;
...
L560: if (resourceIds.length === 0) {
L561: return { status: 200, body: { matched: 0 } };
L562: }
...
L4132: function toAbsolutePath(candidatePath) {
L4133: return normalize(isAbsolute(candidatePath) ? candidatePath : resolve(process.cwd(), candidatePath)
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/chunk-A77V6K33.js View on unpkg · L63 2 L3: var chunkQMAX6QL4_cjs = require('../chunk-QMAX6QL4.cjs');
L4: var chunkLJZJTTI6_cjs = require('../chunk-LJZJTTI6.cjs');
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/relevance/index.cjs View on unpkg · L2 • path = dist/chunk-QMAX6QL4.cjs
kind = oversized_source_file
sizeBytes = 2136572
magicHex = [redacted]
High Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/chunk-QMAX6QL4.cjs View on unpkg dist/docs/references/reference-storage-clickhouse.md View file 261 patternName = generic_password
severity = medium
line = 261
matchedText = password...rd',
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-storage-clickhouse.md
dist/docs/references/reference-storage-clickhouse.md View on unpkg · L261 dist/docs/references/reference-storage-postgresql.md View file 107 patternName = generic_password
severity = medium
line = 107
matchedText = password...rd',
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-storage-postgresql.md
dist/docs/references/reference-storage-postgresql.md View on unpkg · L107 dist/docs/references/reference-storage-mssql.md View file 79 patternName = generic_password
severity = medium
line = 79
matchedText = password...rd',
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-storage-mssql.md
dist/docs/references/reference-storage-mssql.md View on unpkg · L79 89 patternName = generic_password
severity = medium
line = 89
matchedText = password...rd',
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-storage-mssql.md
dist/docs/references/reference-storage-mssql.md View on unpkg · L89 dist/docs/references/reference-vectors-pg.md View file 55 patternName = generic_password
severity = medium
line = 55
matchedText = password...rd',
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-vectors-pg.md
dist/docs/references/reference-vectors-pg.md View on unpkg · L55 dist/docs/references/reference-storage-redis.md View file 37 patternName = generic_password
severity = medium
line = 37
matchedText = password...rd',
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-storage-redis.md
dist/docs/references/reference-storage-redis.md View on unpkg · L37 Medium
Secret Pattern
dist/docs/references/reference-storage-mssql.md
Medium Secret Pattern dist/docs/references/reference-storage-mssql.md
Medium Secret Pattern dist/docs/references/reference-vectors-pg.md
Medium Secret Pattern dist/docs/references/reference-storage-redis.md
types → dist/index.d.ts
exports map
Artifact 62.8 MB · 2,840 files 1 signature(s) · provenance
Install lifecycle No install hooks · other: build:lib, build:patch-commonjs, build:watch, check +6
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem NativeBindings Network Shell WebSocket HighEntropyStrings Minified Telemetry UrlStrings Manifest: clean
LPM CLI
@mastra/core: Clean npm security report (Allow) | LPM Firewall
13 flagged • matchType = previous_version_dangerous_delta
matchedPackage = @mastra/core@1.48.0
matchedIdentity = npm:QG1hc3RyYS9jb3Jl:1.48.0
similarity = 0.842
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-A77V6K33.js View on unpkg 63 import { createRequire } from 'module';
L64: import { execFileSync } from 'child_process';
L65: import { StringDecoder } from 'string_decoder';
High Child Process
Package source references child process execution.
dist/chunk-A77V6K33.js View on unpkg · L63 41835 L41836: // src/workspace/sandbox/execa.ts
L41837: var cached2;
63 import { createRequire } from 'module';
L64: import { execFileSync } from 'child_process';
L65: import { StringDecoder } from 'string_decoder';
...
L4283: });
L4284: this.readFile = options.readFile ?? ((path7) => readFileSync(path7, "utf-8"));
L4285: this.getIgnoredInstructionPaths = options.getIgnoredInstructionPaths;
...
L4501: Rules:
L4502: - Call the available tools via the \`external_*\` functions declared below. Each
L4503: returns a Promise \u2014 \`await\` it.
...
L35048: var HttpRemoteStrategy = class _HttpRemoteStrategy {
L35049: #baseUrl;
L35050: #auth;
High Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/chunk-A77V6K33.js View on unpkg · L63 63 Cross-file remote execution chain: dist/chunk-A77V6K33.js spawns dist/chunk-25T7U65K.js; helper contains network access plus dynamic code execution.
L63: import { createRequire } from 'module';
L64: import { execFileSync } from 'child_process';
L65: import { StringDecoder } from 'string_decoder';
...
L187: if (sdkTool.inputSchema) {
L188: if ("$schema" in sdkTool.inputSchema && typeof sdkTool.inputSchema.$schema === "string" && sdkTool.inputSchema.$schema.startsWith("http://json-schema.org/")) {
L189: parameters = sdkTool.inputSchema;
...
L560: if (resourceIds.length === 0) {
L561: return { status: 200, body: { matched: 0 } };
L562: }
...
L4132: function toAbsolutePath(candidatePath) {
L4133: return normalize(isAbsolute(candidatePath) ? candidatePath : resolve(process.cwd(), candidatePath)
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/chunk-A77V6K33.js View on unpkg · L63 Lines 1-22 javascript
3 var chunkQMAX6QL4_cjs = require ( '../chunk-QMAX6QL4.cjs' );
4 var chunkLJZJTTI6_cjs = require ( '../chunk-LJZJTTI6.cjs' );
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/relevance/index.cjs View on unpkg · L2 • path = dist/chunk-QMAX6QL4.cjs
kind = oversized_source_file
sizeBytes = 2136572
magicHex = [redacted]
High Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/chunk-QMAX6QL4.cjs View on unpkg dist/docs/references/reference-storage-clickhouse.md View file Lines 241-281 markdown
242 ClickHouse runs anywhere you can reach it over HTTP. Two common choices:
244 - **[ ClickHouse Cloud ]( https://clickhouse.com/cloud )** : Managed service with a free trial tier. Provides connection details directly compatible with `url` , `username` , and `password` .
dist/docs/references/reference-storage-postgresql.md View file Lines 87-127 markdown
87 connectionString: 'postgresql://user:password@localhost:5432/mydb',
90 // Using a connection string with pool options
91 const store2 = new PostgresStore({
93 connectionString: 'postgresql://user:password@localhost:5432/mydb',
94 schemaName: 'custom_schema',
95 max: 30, // Max pool connections
96 idleTimeoutMillis: 60000, // Idle timeout
dist/docs/references/reference-storage-mssql.md View file Lines 59-99 markdown
59 id: 'mssql-storage-1',
61 'Server=localhost,1433;Database=mydb;User Id=sa;Password=password;Encrypt=true;TrustServerCertificate=true',
64 // Using a connection string with a custom schema name
65 const store2 = new MSSQLStore({
66 id: 'mssql-storage-2',
68 'Server=localhost,1433;Database=mydb;User Id=sa;Password=password;Encrypt=true;TrustServerCertificate=true',
dist/docs/references/reference-vectors-pg.md View file 55 patternName = generic_password
severity = medium
line = 55
matchedText = password...rd',
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-vectors-pg.md
dist/docs/references/reference-vectors-pg.md View on unpkg · L55 dist/docs/references/reference-storage-redis.md View file 37 patternName = generic_password
severity = medium
line = 37
matchedText = password...rd',
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-storage-redis.md
dist/docs/references/reference-storage-redis.md View on unpkg · L37 6 // src/relevance/relevance-score-provider.ts
7 function createSimilarityPrompt ( query , text ) {
8 return `Rate the semantic similarity between the following the query and the text on a scale from 0 to 1 (decimals allowed), where 1 means exactly the same meaning and 0 means completely different:
14 Relevance score (0-1):` ;
17 // src/relevance/mastra-agent/index.ts
18 var MastraAgentRelevanceScorer = class {
20 constructor ( name , model ) {
21 this .agent = new chunkQMAX6QL4_cjs. Agent ({
22 id: `relevance-scorer-${ name }` ,
: Run the official [
`clickhouse/clickhouse-server`
](
https://hub.docker.com/r/clickhouse/clickhouse-server
) container or install from the [
official packages
](
https://clickhouse.com/docs/en/install
). Suitable for VPS, dedicated hardware, or Kubernetes.
247 For local development:
250 docker run -d --name mastra-clickhouse \
251 -p 8123:8123 -p 9000:9000 \
252 -e CLICKHOUSE_USER=default \
253 -e CLICKHOUSE_PASSWORD=password \
254 clickhouse/clickhouse-server
258 new ObservabilityStorageClickhouseVNext ({
259 url: 'http://localhost:8123' ,
261 password: 'password' ,
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-storage-clickhouse.md
dist/docs/references/reference-storage-clickhouse.md View on unpkg · L261 265 ## Deploying with Railway and similar platforms
267 Platforms like [ Railway ]( https://railway.com ), [ Fly.io ]( https://fly.io ), [ Render ]( https://render.com ), and Heroku run application containers on ephemeral filesystems. Embedded observability backends such as DuckDB require a writable, persistent local file, so they either lose data on restart or fail to deploy entirely on these platforms.
269 Use ClickHouse instead. Because ClickHouse is reached over HTTP, the same connection works from any host:
272 import { Mastra } from '@mastra/core'
273 import { MastraCompositeStore } from '@mastra/core/storage'
274 import { PostgresStore } from '@mastra/pg'
275 import { ObservabilityStorageClickhouseVNext } from '@mastra/clickhouse'
276 import { Observability, MastraStorageExporter } from '@mastra/observability'
278 export const mastra = new Mastra ({
279 storage: new MastraCompositeStore ({
280 id: 'composite-storage' ,
281 default: new PostgresStore ({
ssl: { rejectUnauthorized: false },
100 // Using individual connection parameters
101 const store3 = new PostgresStore({
107 password: 'password',
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-storage-postgresql.md
dist/docs/references/reference-storage-postgresql.md View on unpkg · L107 110 // Using a pre-configured pg.Pool (recommended for pool reuse)
111 const existingPool = new Pool({
112 connectionString: 'postgresql://user:password@localhost:5432/mydb',
114 // ... your custom pool configuration
117 const store4 = new PostgresStore({
120 schemaName: 'custom_schema', // optional
69
schemaName: 'custom_schema', // optional
72 // Using individual connection parameters
73 const store4 = new MSSQLStore({
74 id: 'mssql-storage-3',
79 password: 'password',
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-storage-mssql.md
dist/docs/references/reference-storage-mssql.md View on unpkg · L79 82 // Individual parameters with schemaName
83 const store5 = new MSSQLStore({
84 id: 'mssql-storage-4',
90 schemaName: 'custom_schema', // optional
98 The storage implementation handles schema creation and updates automatically. It creates the following tables:
89 patternName = generic_password
severity = medium
line = 89
matchedText = password...rd',
Medium Secret Pattern
Hardcoded password in dist/docs/references/reference-storage-mssql.md
dist/docs/references/reference-storage-mssql.md View on unpkg · L89