registry / @mastra/deployer-vercel / 1.2.9

@mastra/deployer-vercel@1.2.9

AI Security Review

scanned 26d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package provides an explicitly invoked Vercel deployment adapter that writes deployment artifacts into the caller’s project.

Static reason

One or more suspicious static signals were detected.

Trigger

User configures and invokes VercelDeployer during a Mastra build/deployment.

Impact

Creates .vercel/output artifacts and a same-origin Studio configuration; no install-time execution, exfiltration, or persistence found.

Mechanism

Generate Vercel function routes/configuration and optionally copy Studio static assets.

Rationale

Direct inspection found no lifecycle hook or concrete malicious chain. File and environment handling is aligned with the documented, user-invoked Vercel deployment function.

Evidence

package.jsondist/index.jsdist/index.cjsdist/studio/index.htmldist/studio/assets/tsx-B6W0miNI.jsdist/studio/assets/livekit-client.esm-CKIgC2IJ.js.vercel/output/functions/index.func/.vc-config.json.vercel/output/config.json.vercel/output/static/index.html

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence with false-positive risk.

@mastra/deployer-vercel@1.2.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code