@mastra/daytona@0.11.3

Daytona cloud sandbox provider for Mastra workspaces

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Source inspection found no install lifecycle hook in the package manifest and no attack behavior in the required SDK entry files. The weak-crypto hint refers to MD5-based temporary filename derivation, not security-sensitive cryptography.

Static reason

No blocking static signals were detected.

Trigger

Consumers import and use the Daytona adapter or its SDK dependency.

Impact

No malicious behavior was established from these inspected sources.

Mechanism

The adapter uses mount-path hashes for temporary paths; the dependency entrypoints export Daytona SDK APIs.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes the built runtime and declares @daytonaio/sdk as its runtime dependency; it defines no install lifecycle hook.
The required SDK manifest has only a documentation script, and its CommonJS and ESM entrypoints export the Daytona SDK API.
The weak-crypto matches hash mount paths to form temporary credential or mount configuration filenames; they do not use MD5 for security decisions.

Evidence against

Behavioral surface

Source

CryptoFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 137 KB of source, external domains: github.com, packages.cloud.google.com, packages.microsoft.com, storage.googleapis.com

Source & flagged code

8 flagged

dist/index.jsView file

Lines 48-88javascript

48* Validate and normalize a mount prefix before interpolating into shell commands.

49* Returns the normalized prefix (no leading/trailing slashes).

50*

51* Shell safety is handled by shellQuote() at the call site, so this function

52* only enforces path-level rules (no traversal, no empty result, no control chars).

53*/

54function validatePrefix(prefix) {

55 let normalized = prefix;

56 while (normalized.startsWith("/")) normalized = normalized.slice(1);

57 while (normalized.endsWith("/")) normalized = normalized.slice(0, -1);

58 if (!normalized) throw new Error("Mount prefix cannot be empty after normalization.");

59 if (normalized.includes("//") || normalized.split("/").some((s) => s === "." || s === "..")) throw new Error(`Invalid mount prefix: "${

60 if (/[\x00-\x1f\x7f]/.test(normalized)) throw new Error(`Invalid mount prefix: "${prefix}". Control characters are not allowed.`);

61 return normalized;

62}

63/**

64* Run a command in the Daytona sandbox.

65*

66* Thin wrapper around `sandbox.process.executeCommand` that converts timeout

67* from milliseconds to seconds and null-coalesces the output string.

68*

69* Does NOT throw on non-zero exit codes — callers should check `exitCode`.

70*/

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L68

71async function runCommand(sandbox, command, options) {

72 const result = await sandbox.process.executeCommand(command, void 0, void 0, options?.timeout !== void 0 ? Math.ceil(options.timeout / 1e3) : void

73 return {

74 exitCode: result.exitCode,

75 output: result.result ?? ""

76 };

77}

78//#endregion

79//#region src/sandbox/mounts/s3-credentials.ts

80function s3CredentialsPrefix(mountPath) {

81 return `/tmp/.mastra-s3-${createHash("sha256").update(mountPath.replace(/\/$/, "")).digest("hex")}-`;

82}

83/** Remove credentials only after their s3fs process has exited, including after reconnects. */

84async function cleanupS3Credentials(mountPath, ctx) {

85 const script = `test -r /proc/self/comm || exit 1

86credentials_in_use() {

87 for process in /proc/[0-9]*; do

88 test -d "$process" || continue

Lines 244-284javascript

244 logger.warn(`${LOG_PREFIX} gcsfuse install failed for "${detectedCodename}", retrying with "${fallbackCodename}" fallback`);

245 await run(`sudo rm -f /etc/apt/sources.list.d/gcsfuse.list && echo "deb [signed-by=/etc/apt/keyrings/gcsfuse.gpg] https://packages.cloud.google.com/apt gcsfuse-${fallbackCodename} main" | sudo tee /etc/apt/sources.list.d/gcsfuse.list`, 1e4);

246 await run(

Lines 437-477javascript

437 const repoSetup = await run("sudo mkdir -p /etc/apt/keyrings && curl --retry 3 --retry-all-errors --retry-delay 2 -fsSL https://packages.microsoft.com/keys/microsoft.asc -o /tmp/ms-key.asc && sudo gpg --batch --yes --dearmor -o /etc/apt/keyrings/microsoft.gpg /tmp/ms-key.asc", 3e4);

438 let installResult;

439 if (repoSetup.exitCode === 0) for (

package.jsonView file

Lines 2-69json

2 "name": "@mastra/daytona",

3 "version": "0.11.3",

4 "description": "Daytona cloud sandbox provider for Mastra workspaces",

5 "type": "module",

6 "main":

.lpm-dependency-evidence-bee9fa84-774d-444e-aed0-50867a1fe4f3/0/npm-linux/package.jsonView file

62"scripts": { "docs": "bash -O extglob -c 'rm -rf $npm[redacted]/!(index.mdx)' && typedoc && rm -f $npm[redacted]/readme.mdx" }, "keywords": [

Low

Ai Review Evidence

The required SDK manifest has only a documentation script, and its CommonJS and ESM entrypoints export the Daytona SDK API.

.lpm-dependency-evidence-bee9fa84-774d-444e-aed0-50867a1fe4f3/0/npm-linux/package.jsonView on unpkg · L62

.lpm-dependency-evidence-bee9fa84-774d-444e-aed0-50867a1fe4f3/0/npm-linux/cjs/index.jsView file

10var Daytona_1 = require("./Daytona"); Object.defineProperty(exports, "CodeLanguage", { enumerable: true, get: function () { return Daytona_1.CodeLanguage; } }); Object.defineProper

Low

Ai Review Evidence

The required SDK manifest has only a documentation script, and its CommonJS and ESM entrypoints export the Daytona SDK API.

.lpm-dependency-evidence-bee9fa84-774d-444e-aed0-50867a1fe4f3/0/npm-linux/cjs/index.jsView on unpkg · L10

.lpm-dependency-evidence-bee9fa84-774d-444e-aed0-50867a1fe4f3/0/npm-linux/esm/index.jsView file

5export { CodeLanguage, Daytona } from './Daytona.js'; export { FileSystem } from './FileSystem.js'; export { Git } from './Git.js'; export { LspLanguageId } from './LspServer.js';

Low

Ai Review Evidence

The required SDK manifest has only a documentation script, and its CommonJS and ESM entrypoints export the Daytona SDK API.

.lpm-dependency-evidence-bee9fa84-774d-444e-aed0-50867a1fe4f3/0/npm-linux/esm/index.jsView on unpkg · L5

Source & flagged code

8 flagged · loading source

dist/index.jsView file

68* L69: * Does NOT throw on non-zero exit codes — callers should check `exitCode`. L70: */ ... L117: try { L118: if ((await ctx.run(`sh -c ${shellQuote(script)}`, 3e4)).exitCode !== 0) ctx.logger.warn(`${LOG_PREFIX} S3 credentials retained: daemon still active or cleanup could not be verified... L119: } catch { ... L163: if (config.accessKeyId && config.secretAccessKey) { L164: if ((await run(`mkdir -m 700 ${shellQuote(credentialsDirectory)}`, 3e4)).exitCode !== 0) throw new Error("Failed to create private S3 credentials directory"); L165: credentialsCreated = true; ... L224: const quotedMountPath = shellQuote(mountPath); L225: const connectivityCheck = await run("curl -sS --max-time 5 http://storage.googleapis.com 2>&1", 1e4); L226: const checkOutput = connectivityCheck.stdout.trim();

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L68

264const keyPath = `/tmp/gcs-key-${createHash("md5").update(mountPath).digest("hex").slice(0, 8)}.json`; await run(`sudo rm -f ${shellQuote(keyPath)}`, 3e4); await writeFile(keyPa

Low

Ai Review Evidence

The weak-crypto matches hash mount paths to form temporary credential or mount configuration filenames; they do not use MD5 for security decisions.

dist/index.jsView on unpkg · L264

457const mountHash = createHash("md5").update(mountPath).digest("hex").slice(0, 8); const configPath = `/tmp/.blobfuse2-config-${mountHash}.yaml`; const cachePath = `/tmp/blobfuse2-

Findings

12 Low

LowScripts Present

LowWeak Cryptodist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidence.lpm-dependency-evidence-bee9fa84-774d-444e-aed0-50867a1fe4f3/0/npm-linux/package.json

LowAi Review Evidence.lpm-dependency-evidence-bee9fa84-774d-444e-aed0-50867a1fe4f3/0/npm-linux/cjs/index.js

LowAi Review Evidence.lpm-dependency-evidence-bee9fa84-774d-444e-aed0-50867a1fe4f3/0/npm-linux/esm/index.js

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @mastra/daytona@0.11.3.

See all versions of @mastra/daytona for other recorded verdicts.

Review the evidence and your use of @mastra/daytona@0.11.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 11:59:30.880Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code