registry / @mastra/deployer-cloud / 1.79.0
@mastra/deployer-cloud@1.79.0
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe package has no install hook, and inspected runtime behavior is consistent with cloud deployment, configured logging, and status reporting. No concrete malicious behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
Using the deployer to bundle or start a cloud deployment.
Impact
No confirmed attack surface was established; the observed activity supports deployment and configured cloud services.
Mechanism
The package prepares a user project, optionally copies studio assets, and creates reporting and logging clients from environment-provided settings; reporting and runner-log setup are skipped in CI.
AI rationale
The package has no install hook, and inspected runtime behavior is consistent with cloud deployment, configured logging, and status reporting. No concrete malicious behavior was identified.
Evidence
package.jsondist/index.js.lpm-dependency-evidence-b35a0115-e401-4a19-a901-f4110fda5a6c/0/npm-linux/index.js.lpm-dependency-evidence-b35a0115-e401-4a19-a901-f4110fda5a6c/1/npm-linux/lib/esm.mjs.lpm-dependency-evidence-b35a0115-e401-4a19-a901-f4110fda5a6c/2/npm-linux/dist/index.js
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hook; its scripts are for building, testing, and linting.
- The runtime sends build status and runner logs only to environment-configured services, with both sends disabled in CI; storage likewise uses configured credentials and a configured URL.
- The deployer bundles a user project, optionally copies studio assets, and installs dependencies through its deployer method.
- The inspected execa source and its required modules handle subprocess and stream input, output, and transforms; no unrelated collection or transfer is shown in these paths.
- The inspected fs-extra and Redis modules are used for file copying, package metadata reading, and configured logging.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/studio/assets/main-CPed5rup.jsView file
•path = dist/studio/assets/main-CPed5rup.js
kind = oversized_source_file
sizeBytes = 6097540
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/studio/assets/main-CPed5rup.jsView on unpkgpackage.jsonView file
2"name": "@mastra/deployer-cloud",
"version": "1.79.0",
"description": "",
"type": "module",
"files": [
"dist",
"versions.json"
],
Low
Suspicious Lifecycle Evidence
The manifest has no install lifecycle hook; its scripts are for building, testing, and linting.
package.jsonView on unpkg · L264"scripts": {
"build": "tsdown --silent --config tsdown.config.ts",
"build:watch": "tsdown --watch --silent --config tsdown.config.ts",
"test": "vitest run",
"lint
Findings
4 Medium8 Low
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/studio/assets/main-CPed5rup.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @mastra/deployer-cloud@1.79.0.
See all versions of @mastra/deployer-cloud for other recorded verdicts.
- Review the evidence and your use of @mastra/deployer-cloud@1.79.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.