registry / @mastra/core / 1.78.0
@mastra/core@1.78.0
⚠ Under reviewStatic Scan Results
scanned 8d ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flagged · loading sourcedist/signal-provider-DMWpgmcG.cjsView file
1const require_task_state_processor = require("./task-state-processor-DN0BlaT4.cjs");
L2: //#region src/signals/signal-provider.ts
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/signal-provider-DMWpgmcG.cjsView on unpkg · L1dist/feature-telemetry-CKMYBeaO.cjsView file
6let posthog_node = require("posthog-node");
L7: let child_process = require("child_process");
L8: //#region src/telemetry/posthog.ts
L9: const POSTHOG_API_KEY = "phc_SBLpZVAB6jmHOct9CABq3PF0Yn5FU3G2FgT4xUr2XrT";
L10: const POSTHOG_HOST = "https://us.posthog.com";
L11: const TRUTHY_DISABLED_VALUES = /* @__PURE__ */ new Set([
...
L17: function isTelemetryEnabled() {
L18: const value = process.env["MASTRA_TELEMETRY_DISABLED"];
L19: if (!value) return true;
...
L24: }
L25: function getHashedHostname() {
L26: return hashTelemetryValue(os.default.hostname() || "unknown-host").slice(0, 16);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/feature-telemetry-CKMYBeaO.cjsView on unpkg · L6Findings
3 High4 Medium6 Low
HighSandbox Evasion Gated Capabilitydist/feature-telemetry-CKMYBeaO.cjs
HighSemantic Analysis Limiteddist/filesystem-versioned-CHOxyxzJ.cjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/filesystem-versioned-CHOxyxzJ.cjs
MediumDynamic Requiredist/signal-provider-DMWpgmcG.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/core@1.78.0.
See all versions of @mastra/core for other recorded verdicts.
- Review the evidence and your use of @mastra/core@1.78.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.