registry / @mastra/deployer / 1.56.0

@mastra/deployer@1.56.0

Static Scan Results

scanned 27d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 1011 KB of source, external domains: agentskills.io, cdn.jsdelivr.net, cdnjs.cloudflare.com, github.com, json-schema.org, mastra.ai, output.signals.mastra.ai, tools.ietf.org

Source & flagged code

5 flagged

dist/services-Cw3Ho44Z.cjsView file

Lines 1-21javascript

1const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");

2let child_process = require("child_process");

3let fs = require("fs");

High

Child Process

Package source references child process execution.

dist/services-Cw3Ho44Z.cjsView on unpkg · L1

4fs = require_rolldown_runtime.__toESM(fs, 1);

5let fs_promises = require("fs/promises");

6fs_promises = require_rolldown_runtime.__toESM(fs_promises, 1);

7let path = require("path");

8path = require_rolldown_runtime.__toESM(path, 1);

9let fs_extra_esm = require("fs-extra/esm");

10fs_extra_esm = require_rolldown_runtime.__toESM(fs_extra_esm, 1);

11let url = require("url");

12let _mastra_core_base = require("@mastra/core/base");

13let stream = require("stream");

14//#region src/deploy/log.ts

15const createPinoStream = (logger) => {

16 return new stream.Writable({ write(chunk, _encoding, callback) {

17 const line = chunk.toString().trim();

18 if (line) {

19 console.info(line);

20 logger.info(line);

21 }

dist/services-CHz7RuZ1.jsView file

Lines 1-41javascript

1import { spawn } from "child_process";

2import * as fs$1 from "fs";

3import fs from "fs";

4import fsPromises from

dist/validator/custom-resolver.cjsView file

Lines 1-21javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

2const require_utils = require("../utils-O98BGdnP.cjs");

3let fs = require("fs");

dist/analyze-C6SiypMS.cjsView file

Lines 1-24javascript

1const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");

2const require_utils = require("./utils-O98BGdnP.cjs");

3const require_services =

dist/bundler/index.jsView file

Lines 88-128javascript

88 pnpmOverrides

89 });

90 }

91 /**

92 * Generate a package-lock.json for the output directory so that deploy targets

93 * can use `npm ci` instead of `npm install`, skipping version resolution entirely.

94 * This is a lockfile-only operation — no packages are downloaded.

95 *

96 * Temporarily moves node_modules out of the way because pnpm's symlink-based

97 * layout confuses npm's arborist, then restores it afterwards so that

Source & flagged code

5 flagged · loading source

dist/services-Cw3Ho44Z.cjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code