registry / @mastra/deployer-sandbox / 0.3.2
@mastra/deployer-sandbox@0.3.2
Deploy a Mastra server into any workspace sandbox that supports networking and get a live public URL
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
Oversized source lightweight scan
dist/studio/assets/main-v7G9bA48.js6.74 MB file, sampled 256 KB
HighEntropyStringsMinifiedUrlStringsmastra.aireact.dev
Source & flagged code
4 flaggeddist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView on unpkg · L13dist/studio/assets/tsx-B6W0miNI.jsView file
1const e=Object.freeze(JSON.parse(`{"displayName":"TSX","name":"tsx","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-mo...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/studio/assets/tsx-B6W0miNI.jsView on unpkg · L1dist/index.jsView file
Findings
1 High7 Medium4 Low
HighEntrypoint Foreign Package Code Overwritedist/index.js
MediumSecret Patterndist/studio/assets/livekit-client.esm-CKIgC2IJ.js
MediumDynamic Requiredist/studio/assets/tsx-B6W0miNI.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumOversized Source Filedist/studio/assets/main-v7G9bA48.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/deployer-sandbox@0.3.2.
See all versions of @mastra/deployer-sandbox for other recorded verdicts.
- Review the evidence and your use of @mastra/deployer-sandbox@0.3.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.