registry / @mastra/core / 1.49.0

@mastra/core@1.49.0

AI Security Review

scanned 17d ago · by lpm-firewall-ai

The package exposes agent framework capabilities, including sandbox command execution and workspace filesystem tools. These are runtime APIs for Mastra agents rather than install-time or import-time behavior, and no confirmed malicious delivery path was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit runtime use of Mastra workspace/coding-agent APIs with configured sandbox/filesystem/tools

Impact

Can execute commands or modify files only when the consuming application wires those capabilities into an agent workspace; no unconsented package install/import action identified.

Mechanism

caller-configured agent workspace command and file tools

Rationale

Static inspection shows powerful but package-aligned AI agent/workspace primitives and no lifecycle hook, hardcoded exfiltration endpoint, persistence, or unconsented foreign agent control-surface mutation. The scanner's command/file/network findings map to documented runtime framework APIs that require explicit consumer configuration.

Evidence

package.jsondist/chunk-A77V6K33.jsdist/relevance/index.cjsdist/index.jsdist/index.cjs

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/chunk-A77V6K33.js contains user-exposed workspace tools for shell execution and file writes/deletes
LocalFilesystem supports contained:false, allowing host filesystem access when explicitly configured

Evidence against

package.json has no preinstall/install/postinstall/prepare lifecycle hooks
No source evidence of install-time mutation of Claude/Codex/Cursor/MCP config or agent control surfaces
Dangerous primitives are exported runtime agent/workspace APIs gated by caller-provided workspace, sandbox, filesystem, and tool configuration
Filesystem write/delete tools check readOnly/permissions; local filesystem defaults to contained:true
Remote HTTP worker uses caller-provided serverUrl and MASTRA_WORKER_AUTH_TOKEN for Mastra workflow execution, not hardcoded exfiltration
No hardcoded attacker endpoints or credential harvesting flow found in inspected hot files

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Source & flagged code

13 flagged

dist/chunk-A77V6K33.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/core@1.48.0 matchedIdentity = npm:QG1hc3RyYS9jb3Jl:1.48.0 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-A77V6K33.jsView on unpkg

63import { createRequire } from 'module'; L64: import { execFileSync } from 'child_process'; L65: import { StringDecoder } from 'string_decoder';

High

Child Process

Package source references child process execution.

dist/chunk-A77V6K33.jsView on unpkg · L63

41835L41836: // src/workspace/sandbox/execa.ts L41837: var cached2;

High

Shell

Package source references shell execution.

dist/chunk-A77V6K33.jsView on unpkg · L41835

63import { createRequire } from 'module'; L64: import { execFileSync } from 'child_process'; L65: import { StringDecoder } from 'string_decoder'; ... L4283: }); L4284: this.readFile = options.readFile ?? ((path7) => readFileSync(path7, "utf-8")); L4285: this.getIgnoredInstructionPaths = options.getIgnoredInstructionPaths; ... L4501: Rules: L4502: - Call the available tools via the \`external_*\` functions declared below. Each L4503: returns a Promise \u2014 \`await\` it. ... L35048: var HttpRemoteStrategy = class _HttpRemoteStrategy { L35049: #baseUrl; L35050: #auth;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-A77V6K33.jsView on unpkg · L63

63Cross-file remote execution chain: dist/chunk-A77V6K33.js spawns dist/chunk-25T7U65K.js; helper contains network access plus dynamic code execution. L63: import { createRequire } from 'module'; L64: import { execFileSync } from 'child_process'; L65: import { StringDecoder } from 'string_decoder'; ... L187: if (sdkTool.inputSchema) { L188: if ("$schema" in sdkTool.inputSchema && typeof sdkTool.inputSchema.$schema === "string" && sdkTool.inputSchema.$schema.startsWith("http://json-schema.org/")) { L189: parameters = sdkTool.inputSchema; ... L560: if (resourceIds.length === 0) { L561: return { status: 200, body: { matched: 0 } }; L562: } ... L4132: function toAbsolutePath(candidatePath) { L4133: return normalize(isAbsolute(candidatePath) ? candidatePath : resolve(process.cwd(), candidatePath)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-A77V6K33.jsView on unpkg · L63

dist/relevance/index.cjsView file

Lines 1-22javascript

1'use strict';

3var chunkQMAX6QL4_cjs = require('../chunk-QMAX6QL4.cjs');

4var chunkLJZJTTI6_cjs = require('../chunk-LJZJTTI6.cjs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/relevance/index.cjsView on unpkg · L2

dist/chunk-QMAX6QL4.cjsView file

•path = dist/chunk-QMAX6QL4.cjs kind = oversized_source_file sizeBytes = 2136572 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-QMAX6QL4.cjsView on unpkg

dist/docs/references/reference-storage-clickhouse.mdView file

Lines 241-281markdown

241

242ClickHouse runs anywhere you can reach it over HTTP. Two common choices:

243

244- **[ClickHouse Cloud](https://clickhouse.com/cloud)**: Managed service with a free trial tier. Provides connection details directly compatible with `url`, `username`, and `password`.

245- **Self-hosted**

dist/docs/references/reference-storage-postgresql.mdView file

Lines 87-127markdown

87 connectionString: 'postgresql://user:password@localhost:5432/mydb',

88})

90// Using a connection string with pool options

91const store2 = new PostgresStore({

92 id: 'pg-storage-2',

93 connectionString: 'postgresql://user:password@localhost:5432/mydb',

94 schemaName: 'custom_schema',

95 max: 30, // Max pool connections

96 idleTimeoutMillis: 60000, // Idle timeout

dist/docs/references/reference-storage-mssql.mdView file

Lines 59-99markdown

59 id: 'mssql-storage-1',

60 connectionString:

61 'Server=localhost,1433;Database=mydb;User Id=sa;Password=password;Encrypt=true;TrustServerCertificate=true',

62})

64// Using a connection string with a custom schema name

65const store2 = new MSSQLStore({

66 id: 'mssql-storage-2',

67 connectionString:

68 'Server=localhost,1433;Database=mydb;User Id=sa;Password=password;Encrypt=true;TrustServerCertificate=true',

dist/docs/references/reference-vectors-pg.mdView file

55patternName = generic_password severity = medium line = 55 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/docs/references/reference-vectors-pg.md

dist/docs/references/reference-vectors-pg.mdView on unpkg · L55

dist/docs/references/reference-storage-redis.mdView file

37patternName = generic_password severity = medium line = 37 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/docs/references/reference-storage-redis.md

dist/docs/references/reference-storage-redis.mdView on unpkg · L37

Source & flagged code

13 flagged · loading source

dist/chunk-A77V6K33.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-A77V6K33.jsView on unpkg

63import { createRequire } from 'module'; L64: import { execFileSync } from 'child_process'; L65: import { StringDecoder } from 'string_decoder';

High

Child Process

Package source references child process execution.

dist/chunk-A77V6K33.jsView on unpkg · L63

41835L41836: // src/workspace/sandbox/execa.ts L41837: var cached2;

High

Shell

Package source references shell execution.

dist/chunk-A77V6K33.jsView on unpkg · L41835

Findings

1 Critical5 High10 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/chunk-A77V6K33.js

HighChild Processdist/chunk-A77V6K33.js

HighShelldist/chunk-A77V6K33.js

HighRemote Agent Bridgedist/chunk-A77V6K33.js

HighCross File Remote Execution Contextdist/chunk-A77V6K33.js

HighOversized Source Filedist/chunk-QMAX6QL4.cjs

MediumDynamic Requiredist/relevance/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/docs/references/reference-storage-clickhouse.md

MediumSecret Patterndist/docs/references/reference-storage-postgresql.md