Loading npm security reports…

@mastra/core@1.47.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @mastra/core / 1.47.0

@mastra/core@1.47.0

AI Security Review

scanned 17d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

runtime use of Mastra workspace tools by a configured agent/application

Impact

configured agents/models can run commands and read/write/delete files within the provided workspace/sandbox boundaries

Mechanism

agent-facing workspace shell and filesystem tools

Policy narrative

The scanner-highlighted child_process/shell findings are real but belong to Mastra's workspace/sandbox feature set: command execution, process tracking, and file tools are exported as runtime agent tools. They are not activated by npm lifecycle hooks and do not plant foreign AI-agent configuration. This is dangerous dual-use functionality if exposed to a remote model without policy controls, but the source inspected does not show unconsented persistence, credential harvesting, or exfiltration behavior.

Rationale

Static inspection supports a warning for dangerous agent-facing capability rather than a publish block: the risky shell/file primitives are package-aligned and runtime-configured, with no lifecycle hijack or concrete malicious delivery path found.

Evidence

package.jsondist/chunk-K5JBD726.cjsdist/chunk-JVN7H2TP.jsdist/chunk-ZVZXKOMS.cjs

Network endpoints2

MASTRA_STEP_EXECUTION_URL

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/chunk-K5JBD726.cjs defines mastra_workspace_execute_command with shell command execution and optional background processes.
LocalProcessManager uses execa to spawn commands under the configured sandbox working directory.
Workspace tools include filesystem read/write/edit/delete and command/process tools for agent use.
HttpRemoteStrategy can POST workflow step execution to caller-configured MASTRA_STEP_EXECUTION_URL with optional bearer auth.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks or bin entry.
No code found writing .mcp.json, CLAUDE.md, Codex/Cursor settings, shell startup files, VCS hooks, or autostart entries during install/import.
Network endpoints are framework/user-configured or documentation/provider registry data, not hardcoded attacker C2.
Command/file capabilities require runtime workspace/sandbox context and host application configuration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 304 file(s), 14.4 MB of source, external domains: 127.0.0.1, abacus.ai, ai-gateway.helicone.ai, ai-gateway.vercel.sh, ai-sdk.dev, ai.google.dev, ai.routing.sh, alipaytbox.yuque.com, ambient.xyz, api-docs.deepseek.com, api-inference.modelscope.cn, api-sherlock.cloudferro.com, api.302.ai, api.abliteration.ai, api.ambient.xyz, api.anthropic.com, api.anyapi.ai, api.auriko.ai, api.berget.ai, api.cerebras.ai, api.clarifai.com, api.claudin.io, api.cloudflare.com, api.code.umans.ai, api.cortecs.ai, api.deepinfra.com, api.deepseek.com, api.dinference.com, api.fireworks.ai, api.friendli.ai, api.getlilac.com, api.gmi-serving.com, api.groq.com, api.hpc-ai.com, api.inceptionlabs.ai, api.inceptron.io, api.inference.wandb.ai, api.intelligence.io.solutions, api.jiekou.ai, api.kilo.ai, api.kimi.com, api.lkeap.cloud.tencent.com, api.llama.com, api.llmgateway.io, api.lucidquery.com, api.meganova.ai, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai

Source & flagged code

12 flagged · loading source

dist/chunk-K5JBD726.cjsView file

59var module$1 = require('module'); L60: var child_process = require('child_process'); L61: var string_decoder = require('string_decoder');

High

Child Process

Package source references child process execution.

dist/chunk-K5JBD726.cjsView on unpkg · L59

59var module$1 = require('module'); L60: var child_process = require('child_process'); L61: var string_decoder = require('string_decoder'); ... L3921: }); L3922: this.readFile = options.readFile ?? ((path7) => fs$1.readFileSync(path7, "utf-8")); L3923: this.getIgnoredInstructionPaths = options.getIgnoredInstructionPaths; ... L4139: Rules: L4140: - Call the available tools via the \`external_*\` functions declared below. Each L4141: returns a Promise \u2014 \`await\` it. ... L34291: var HttpRemoteStrategy = class _HttpRemoteStrategy { L34292: #baseUrl; L34293: #auth;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-K5JBD726.cjsView on unpkg · L59

59Cross-file remote execution chain: dist/chunk-K5JBD726.cjs spawns dist/chunk-4SCYX53T.cjs; helper contains network access plus dynamic code execution. L59: var module$1 = require('module'); L60: var child_process = require('child_process'); L61: var string_decoder = require('string_decoder'); ... L216: if (sdkTool.inputSchema) { L217: if ("$schema" in sdkTool.inputSchema && typeof sdkTool.inputSchema.$schema === "string" && sdkTool.inputSchema.$schema.startsWith("http://json-schema.org/")) { L218: parameters = sdkTool.inputSchema; ... L589: if (resourceIds.length === 0) { L590: return { status: 200, body: { matched: 0 } }; L591: } ... L3770: function toAbsolutePath(candidatePath) { L3771: return nodePath.normalize(nodePath.isAbsolute(candidatePath) ? candidatePath : nodePath.resolve(proces

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-K5JBD726.cjsView on unpkg · L59

dist/chunk-JVN7H2TP.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/core@1.48.0 matchedIdentity = npm:QG1hc3RyYS9jb3Jl:1.48.0 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/chunk-JVN7H2TP.jsView on unpkg

40848L40849: // src/workspace/sandbox/execa.ts L40850: var cached2;

High

Shell

Package source references shell execution.

dist/chunk-JVN7H2TP.jsView on unpkg · L40848

dist/chunk-ZVZXKOMS.cjsView file

2L3: var chunk2UAP4LDC_cjs = require('./chunk-2UAP4LDC.cjs'); L4: var crypto$1 = require('crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-ZVZXKOMS.cjsView on unpkg · L2

dist/docs/references/reference-storage-clickhouse.mdView file

259patternName = generic_password severity = medium line = 259 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/docs/references/reference-storage-clickhouse.md

dist/docs/references/reference-storage-clickhouse.mdView on unpkg · L259

dist/docs/references/reference-storage-postgresql.mdView file

105patternName = generic_password severity = medium line = 105 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/docs/references/reference-storage-postgresql.md

dist/docs/references/reference-storage-postgresql.mdView on unpkg · L105

dist/docs/references/reference-storage-mssql.mdView file

77patternName = generic_password severity = medium line = 77 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/docs/references/reference-storage-mssql.md

dist/docs/references/reference-storage-mssql.mdView on unpkg · L77

87patternName = generic_password severity = medium line = 87 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/docs/references/reference-storage-mssql.md

dist/docs/references/reference-storage-mssql.mdView on unpkg · L87

dist/docs/references/reference-vectors-pg.mdView file

53patternName = generic_password severity = medium line = 53 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/docs/references/reference-vectors-pg.md

dist/docs/references/reference-vectors-pg.mdView on unpkg · L53

dist/docs/references/reference-storage-redis.mdView file

35patternName = generic_password severity = medium line = 35 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/docs/references/reference-storage-redis.md

dist/docs/references/reference-storage-redis.mdView on unpkg · L35

Source & flagged code

12 flagged

dist/chunk-K5JBD726.cjsView file

59var module$1 = require('module'); L60: var child_process = require('child_process'); L61: var string_decoder = require('string_decoder');

High

Child Process

Package source references child process execution.

dist/chunk-K5JBD726.cjsView on unpkg · L59

59var module$1 = require('module'); L60: var child_process = require('child_process'); L61: var string_decoder = require('string_decoder'); ... L3921: }); L3922: this.readFile = options.readFile ?? ((path7) => fs$1.readFileSync(path7, "utf-8")); L3923: this.getIgnoredInstructionPaths = options.getIgnoredInstructionPaths; ... L4139: Rules: L4140: - Call the available tools via the \`external_*\` functions declared below. Each L4141: returns a Promise \u2014 \`await\` it. ... L34291: var HttpRemoteStrategy = class _HttpRemoteStrategy { L34292: #baseUrl; L34293: #auth;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-K5JBD726.cjsView on unpkg · L59

59Cross-file remote execution chain: dist/chunk-K5JBD726.cjs spawns dist/chunk-4SCYX53T.cjs; helper contains network access plus dynamic code execution. L59: var module$1 = require('module'); L60: var child_process = require('child_process'); L61: var string_decoder = require('string_decoder'); ... L216: if (sdkTool.inputSchema) { L217: if ("$schema" in sdkTool.inputSchema && typeof sdkTool.inputSchema.$schema === "string" && sdkTool.inputSchema.$schema.startsWith("http://json-schema.org/")) { L218: parameters = sdkTool.inputSchema; ... L589: if (resourceIds.length === 0) { L590: return { status: 200, body: { matched: 0 } }; L591: } ... L3770: function toAbsolutePath(candidatePath) { L3771: return nodePath.normalize(nodePath.isAbsolute(candidatePath) ? candidatePath : nodePath.resolve(proces

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-K5JBD726.cjsView on unpkg · L59

dist/chunk-JVN7H2TP.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/core@1.48.0 matchedIdentity = npm:QG1hc3RyYS9jb3Jl:1.48.0 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/chunk-JVN7H2TP.jsView on unpkg

40848L40849: // src/workspace/sandbox/execa.ts L40850: var cached2;

High

Shell

Package source references shell execution.

dist/chunk-JVN7H2TP.jsView on unpkg · L40848

dist/chunk-ZVZXKOMS.cjsView file

Lines 1-22javascript

1'use strict';

2

3var chunk2UAP4LDC_cjs = require('./chunk-2UAP4LDC.cjs');

4var crypto$1 = require('crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-ZVZXKOMS.cjsView on unpkg · L2

dist/docs/references/reference-storage-clickhouse.mdView file

Lines 239-279markdown

239

240ClickHouse runs anywhere you can reach it over HTTP. Two common choices:

241

242- **[ClickHouse Cloud](https://clickhouse.com/cloud)**: Managed service with a free trial tier. Provides connection details directly compatible with `url`, `username`, and `password`.

243- **Self-hosted**

dist/docs/references/reference-storage-postgresql.mdView file

Lines 85-125markdown

85 connectionString: 'postgresql://user:password@localhost:5432/mydb',

86})

87

88// Using a connection string with pool options

89const store2 = new PostgresStore({

90 id: 'pg-storage-2',

91 connectionString: 'postgresql://user:password@localhost:5432/mydb',

92 schemaName: 'custom_schema',

93 max: 30, // Max pool connections

94 idleTimeoutMillis: 60000, // Idle timeout

95

dist/docs/references/reference-storage-mssql.mdView file

Lines 57-97markdown

57 id: 'mssql-storage-1',

58 connectionString:

59 'Server=localhost,1433;Database=mydb;User Id=sa;Password=password;Encrypt=true;TrustServerCertificate=true',

60})

61

62// Using a connection string with a custom schema name

63const store2 = new MSSQLStore({

64 id: 'mssql-storage-2',

65 connectionString:

66 'Server=localhost,1433;Database=mydb;User Id=sa;Password=password;Encrypt=true;TrustServerCertificate=true',

dist/docs/references/reference-vectors-pg.mdView file

53patternName = generic_password severity = medium line = 53 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/docs/references/reference-vectors-pg.md

dist/docs/references/reference-vectors-pg.mdView on unpkg · L53

dist/docs/references/reference-storage-redis.mdView file

35patternName = generic_password severity = medium line = 35 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/docs/references/reference-storage-redis.md

dist/docs/references/reference-storage-redis.mdView on unpkg · L35