registry / @mastra/deployer-cloud / 1.48.0
@mastra/deployer-cloud@1.48.0
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package is a cloud deployer with user-invoked build and generated-runtime integrations. Source inspection found no lifecycle execution or concrete malicious chain.
Static reason
No blocking static signals were detected.
Trigger
Explicit use of CloudDeployer bundle/install methods or generated server startup
Impact
May install project dependencies and send deployment logs/status to configured cloud services.
Mechanism
Cloud build setup, dependency installation, logging, storage, and status reporting
AI rationale
The package is a cloud deployer with user-invoked build and generated-runtime integrations. Source inspection found no lifecycle execution or concrete malicious chain.
Evidence
package.jsondist/index.jsdist/index.cjsREADME.mddist/studio/index.html
Network endpoints1
redis://localhost:6379
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/index.js invokes npm install only from CloudDeployer.installDependencies()
- Generated runtime posts logs/status only to environment-configured endpoints
- dist/studio bundles standard Studio UI assets, including syntax highlighter code
Evidence against
- package.json has no preinstall/install/postinstall hooks or bin entry
- dist/index.js exports CloudDeployer; no import-time deployment or network action
- Process execution is explicit deployer behavior and uses fixed npm arguments
- Network/auth values are environment-configured cloud logging, storage, and reporting integrations
- No credential harvesting, foreign agent-config writes, eval payload path, or destructive behavior found
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedObfuscated
Source & flagged code
3 flaggeddist/studio/assets/babel-CmeIX3PZ.jsView file
2- Did you mean \`export { '${t}' as '${e}' } from 'some-module'\`?`,ExportDefaultFromAsIdentifier:"'from' is not allowed as an identifier after 'export default'.",ForInOfLoopInitia...
L3: - Did you mean \`import { "${t}" as foo }\`?`,ImportCallArity:"`import()` requires exactly one or two arguments.",ImportCallNotNewExpression:"Cannot use new with import(...).",Impo...
L4: `:`\r
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/studio/assets/babel-CmeIX3PZ.jsView on unpkg · L2dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View file
•path = dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2
kind = high_entropy_blob
sizeBytes = 68648
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View on unpkgFindings
2 High4 Medium5 Low
HighShips High Entropy Blobdist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2
HighOversized Source Filedist/studio/assets/main-CnSLnmky.js
MediumDynamic Requiredist/studio/assets/babel-CmeIX3PZ.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/deployer-cloud@1.48.0.
See all versions of @mastra/deployer-cloud for other recorded verdicts.
- Review the evidence and your use of @mastra/deployer-cloud@1.48.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.