registry / @mastra/deployer-cloud / 1.49.0
@mastra/deployer-cloud@1.49.0
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package is a cloud deployer whose privileged behaviors are reached through explicit deployment methods and generated runtime code, not npm lifecycle execution. Its network/auth configuration is environment-provided and aligns with documented logging, storage, and build-status features.
Static reason
No blocking static signals were detected.
Trigger
Explicit CloudDeployer bundle/install workflow or generated server runtime.
Impact
Expected cloud-deployer behavior; no unconsented install-time execution or exfiltration chain established.
Mechanism
Cloud deployment bundling, dependency installation, logging, storage, and status reporting.
AI rationale
The package is a cloud deployer whose privileged behaviors are reached through explicit deployment methods and generated runtime code, not npm lifecycle execution. Its network/auth configuration is environment-provided and aligns with documented logging, storage, and build-status features.
Evidence
package.jsondist/index.jsREADME.mddist/studio/routes-manifest.jsonoutputDirectory/output
Network endpoints1
redis://localhost:6379
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/index.js invokes a package-manager install only through CloudDeployer.installDependencies().
- Generated runtime code sends logs/status to explicitly configured environment endpoints.
- Package reads cloud tokens only to configure generated auth, logging, and storage.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- dist/index.js exports CloudDeployer; import itself does not run deployment or install commands.
- Network destinations and credentials are supplied by deployment environment variables, not hard-coded.
- No credential/file harvesting, shell payloads, eval, persistence, destructive actions, or agent-control config writes found.
- Studio assets are a bundled UI plus syntax grammars/fonts; no confirmed payload behavior.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
3 flaggeddist/studio/assets/babel-CmeIX3PZ.jsView file
2- Did you mean \`export { '${t}' as '${e}' } from 'some-module'\`?`,ExportDefaultFromAsIdentifier:"'from' is not allowed as an identifier after 'export default'.",ForInOfLoopInitia...
L3: - Did you mean \`import { "${t}" as foo }\`?`,ImportCallArity:"`import()` requires exactly one or two arguments.",ImportCallNotNewExpression:"Cannot use new with import(...).",Impo...
L4: `:`\r
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/studio/assets/babel-CmeIX3PZ.jsView on unpkg · L2dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View file
•path = dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2
kind = high_entropy_blob
sizeBytes = 68648
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View on unpkgFindings
2 High4 Medium5 Low
HighShips High Entropy Blobdist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2
HighOversized Source Filedist/studio/assets/main-DND5bBdQ.js
MediumDynamic Requiredist/studio/assets/babel-CmeIX3PZ.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/deployer-cloud@1.49.0.
See all versions of @mastra/deployer-cloud for other recorded verdicts.
- Review the evidence and your use of @mastra/deployer-cloud@1.49.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.