@mastra/deployer-sandbox@0.3.25
Deploy a Mastra server into any workspace sandbox that supports networking and get a live public URL
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe bundled Studio initializes PostHog telemetry by default and captures exceptions, with a global opt-out but no explicit consent prompt evident in the reviewed code. The source does not establish credential or project-file exfiltration, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user loads the bundled Studio in a browser.
Impact
Studio telemetry and caught exception details may be sent to PostHog without an explicit consent prompt.
Mechanism
The Studio initializes a hard-coded PostHog project unless browser constraints apply or window.MASTRA_TELEMETRY_DISABLED is set; its error boundary captures exceptions.
AI rationale
The bundled Studio initializes PostHog telemetry by default and captures exceptions, with a global opt-out but no explicit consent prompt evident in the reviewed code. The source does not establish credential or project-file exfiltration, so this warrants a warning rather than a block.
Evidence
dist/studio/assets/main-DW8Ek0u0.js
Network endpoints1
us.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundled Studio initializes a PostHog project at us.posthog.com by default and registers mastraSource=playground.
- The Studio’s error boundary sends caught exceptions to its analytics client.
- Telemetry is disabled only for browser constraints or when window.MASTRA_TELEMETRY_DISABLED is set to an accepted true value.
Evidence against
- The manifest shows build, test, and lint scripts; no install lifecycle script is declared.
- The deployer loads environment variables and passes them to the remote sandbox as part of its deployment operation.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/studio/assets/main-DW8Ek0u0.jsView file
•Credential-bearing message sent to a fixed external iframe in dist/studio/assets/main-DW8Ek0u0.js:
import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-BWaJ3C7D.js";import{t as a}from"./preload-helper-CRzLMJPS.js";import{$t as o,At as s,B as c,Bt as l,C as u,Ct as d,Dt as f,E...
`+e.stack}}var ke=Object.prototype.hasOwnProperty,Ae=t.unstable_scheduleCallback,je=t.unstable_cancelCallback,Me=t.unstable_shouldYield,Ne=t.unstable_requestPaint,Pe=t.unstable_now...
]))`;continue}}n.s&&r[e]===`.`?i+=o?`${r[e]}\r\n`:`[${r[e]}\r\n]`:(i+=r[e],r[e]===`\\`?a=!0:o&&r[e]===`]`?o=!1:!o&&r[e]===`[`&&(o=!0))}try{new RegExp(i)}catch{return console.warn(`...
Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let n of e.seen.entries()){let r=n[1];if(t===n[0])a(n);else{if
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/studio/assets/main-DW8Ek0u0.jsView on unpkg•path = dist/studio/assets/main-DW8Ek0u0.js
kind = oversized_source_file
sizeBytes = 6454004
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/studio/assets/main-DW8Ek0u0.jsView on unpkgFindings
1 Critical1 High6 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/studio/assets/main-DW8Ek0u0.js
HighSemantic Analysis Limiteddist/index.cjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/studio/assets/main-DW8Ek0u0.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/studio/assets/main-DW8Ek0u0.js
MediumAi Review Evidencedist/studio/assets/main-DW8Ek0u0.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/deployer-sandbox@0.3.25.
See all versions of @mastra/deployer-sandbox for other recorded verdicts.
- Review the evidence and your use of @mastra/deployer-sandbox@0.3.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.