registry / @mastra/deployer-cloud / 1.61.0
@mastra/deployer-cloud@1.61.0
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
Oversized source lightweight scan
dist/studio/assets/main-CYSBLcdQ.js6.74 MB file, sampled 256 KB
HighEntropyStringsMinifiedUrlStringsmastra.aireact.dev
Source & flagged code
3 flaggeddist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView on unpkg · L13dist/studio/assets/tsx-B6W0miNI.jsView file
1const e=Object.freeze(JSON.parse(`{"displayName":"TSX","name":"tsx","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-mo...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/studio/assets/tsx-B6W0miNI.jsView on unpkg · L1dist/studio/assets/main-CYSBLcdQ.jsView file
Findings
7 Medium4 Low
MediumSecret Patterndist/studio/assets/livekit-client.esm-CKIgC2IJ.js
MediumDynamic Requiredist/studio/assets/tsx-B6W0miNI.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumOversized Source Filedist/studio/assets/main-CYSBLcdQ.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/deployer-cloud@1.61.0.
See all versions of @mastra/deployer-cloud for other recorded verdicts.
- Review the evidence and your use of @mastra/deployer-cloud@1.61.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.