registry / @mastra/deployer / 1.47.0

@mastra/deployer@1.47.0

⚠ Under review

Static Scan Results

scanned 20d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 70 file(s), 1.61 MB of source, external domains: cdn.jsdelivr.net, cdnjs.cloudflare.com, json-schema.org, mastra.ai

Source & flagged code

6 flagged

dist/chunk-FQC6UUHS.jsView file

Lines 1-31javascript

1import { tsConfigPaths, protocolExternalResolver, esbuild, removeDeployer, getPackageRootPath, subpathExternalsResolver, esmShim } from './chunk-ORSNDVAB.js';

2import { slash, isDependencyPartOfPackage, getPackageName, isBuiltinModule, isBareModuleSpecifier, isExternalProtocolImport, getCompiledDepCachePath, rollupSafeName, getNodeResolveOptions } from './chunk-V6F2NMS2.js';

3import { existsSync } from 'fs';

4import { readFile, writeFile } from 'fs/promises';

5import * as path from 'path';

6import { dirname, join, relative, basename as basename$1 } from 'path';

7import * as babel2 from '@babel/core';

8import babel2__default, { types } from '@babel/core';

9import { MastraBaseError, ErrorCategory, ErrorDomain, MastraError } from '@mastra/core/error';

10import * as pkg from 'empathic/package';

11import { createWorkspacesCache, findWorkspaces, findWorkspacesRoot } from 'find-workspaces';

12import { spawn as spawn$1 } from 'child_process';

13import { fileURLToPath, pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

dist/chunk-FQC6UUHS.jsView on unpkg · L11

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-FQC6UUHS.jsView on unpkg · L11

14import { noopLogger } from '@mastra/core/logger';

15import commonjs from '@rollup/plugin-commonjs';

16import json from '@rollup/plugin-json';

17import virtual from '@rollup/plugin-virtual';

18import { readJSON } from 'fs-extra/esm';

19import { resolveModule, getPackageInfo } from 'local-pkg';

20import { rollup } from 'rollup';

21import { basename } from 'path/posix';

22import { optimizeLodashImports } from '@optimize-lodash/rollup-plugin';

23import nodeResolve from '@rollup/plugin-node-resolve';

24import * as resolve from 'resolve.exports';

26// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/stacktrace-parser/0.1.11/63406bc765474556691ebd1b24eaa0c5b032f058a26bbaff13797a2780d98220/node_modules/stacktrace-parser/dist/stack-trace-parser.esm.js

27var UNKNOWN_FUNCTION = "<unknown>";

28function parse(stackString) {

29 var lines = stackString.split("\n");

30 return lines.reduce(function(stack, line) {

31 var parseResult = parseChrome(line) || parseWinjs(line) || parseGecko(line) || parseNode(line) || parseJSC(line);

Lines 220-260javascript

220 import.meta.resolve("@mastra/deployer/loader"),

221 "--input-type=module",

222 "--enable-source-maps",

223 "-e",

224 `${prefixCode};import('${pathToFileURL(file).

dist/sury-CWZTCd75-3KQQJ22C.cjsView file

Lines 1-17javascript

1'use strict';

3var chunkV3EKV6QB_cjs = require('./chunk-V3EKV6QB.cjs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/sury-CWZTCd75-3KQQJ22C.cjsView on unpkg · L2

5// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@standard-community/standard-json/0.3.5/9dbc67da7ef95ab6ba977b83f155ade1f3176d290d47d40a60434eb3472caaac/node_modules/@standard-community/standard-json/dist/sury-CWZTCd75.js

6async

dist/chunk-IQDJEJM3.jsView file

Lines 101-141javascript

101 deps.__setLogger(this.logger);

102 await deps.install({ dir: join(outputDirectory, this.outputDir) });

103 }

104 /**

105 * Generate a package-lock.json for the output directory so that deploy targets

106 * can use `npm ci` instead of `npm install`, skipping version resolution entirely.

dist/chunk-UEH6D24P.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/deployer@1.48.0 matchedIdentity = npm:QG1hc3RyYS9kZXBsb3llcg:1.48.0 similarity = 0.910 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/chunk-UEH6D24P.cjsView on unpkg

Source & flagged code

6 flagged · loading source

dist/chunk-FQC6UUHS.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code