registry / @mastra/deployer-cloud / 1.47.0
@mastra/deployer-cloud@1.47.0
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource implements an opt-in cloud deployer with environment-configured logging, storage, and reporting. No install-time execution or concrete malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
Explicit use of CloudDeployer bundle/install workflow or generated application runtime.
Impact
Configured cloud endpoints may receive build status or logs as part of the declared deployer function.
Mechanism
Cloud deployment build, logging, storage, and status-report configuration.
AI rationale
Source implements an opt-in cloud deployer with environment-configured logging, storage, and reporting. No install-time execution or concrete malicious behavior was found.
Evidence
package.jsondist/index.jsREADME.mddist/studio/assets/babel-CmeIX3PZ.js
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/index.js runs npm install only through CloudDeployer.installDependencies during an explicit deploy build.
- Generated runtime code posts build status and logs only to environment-configured endpoints.
- Generated runtime code uses configured storage and JWT values for cloud services.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- dist/index.js exports CloudDeployer; importing it does not invoke deployment or network calls.
- No hard-coded external endpoint, credential harvesting, eval, shell interpolation, persistence, or agent-config mutation found.
- The Babel asset is a bundled parser dependency, explaining its dynamic-import syntax.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
3 flaggeddist/studio/assets/babel-CmeIX3PZ.jsView file
2- Did you mean \`export { '${t}' as '${e}' } from 'some-module'\`?`,ExportDefaultFromAsIdentifier:"'from' is not allowed as an identifier after 'export default'.",ForInOfLoopInitia...
L3: - Did you mean \`import { "${t}" as foo }\`?`,ImportCallArity:"`import()` requires exactly one or two arguments.",ImportCallNotNewExpression:"Cannot use new with import(...).",Impo...
L4: `:`\r
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/studio/assets/babel-CmeIX3PZ.jsView on unpkg · L2dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View file
•path = dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2
kind = high_entropy_blob
sizeBytes = 68648
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View on unpkgFindings
2 High4 Medium5 Low
HighShips High Entropy Blobdist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2
HighOversized Source Filedist/studio/assets/main-04biggqk.js
MediumDynamic Requiredist/studio/assets/babel-CmeIX3PZ.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/deployer-cloud@1.47.0.
See all versions of @mastra/deployer-cloud for other recorded verdicts.
- Review the evidence and your use of @mastra/deployer-cloud@1.47.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.