registry / Credential exfiltration / @mastra/deployer / 1.63.0

@mastra/deployer@1.63.0

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The proxy forwards an existing platform token to an unrestricted configurable endpoint, creating conditional credential exposure. Other flagged process calls are tied to deploy lockfile generation and supplied-file validation, and the manifest shows no install lifecycle hook.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A request reaches the proxy on a loopback host while the platform token and project ID are set; an operator may also configure a different endpoint.

Impact

If configured with an unintended recipient, the proxy discloses the platform token to that recipient; the source does not establish that this occurs by default.

Mechanism

The proxy builds the upstream URL from the configured endpoint and sends the platform token in its Authorization header without checking the destination host.

AI rationale

Evidence

dist/server/index.js

Network endpoints1

output.signals.mastra.ai

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package scripts contain build, test, and lint tasks, with no install lifecycle hook shown.
The proxy uses a Mastra endpoint by default and accepts requests only from loopback hosts with matching origins.
The proxy requires a platform token and project ID, then builds the upstream URL from an environment-configured endpoint without restricting its host.
The upstream GET includes the platform token as a bearer credential.
The flagged package manager call is in a deploy output lockfile-generation method and uses the lockfile-only option.
The validator child process imports the supplied file as part of validation; the ESM and CommonJS builds show this flow.

Evidence against

The token transfer is part of an Agent Learning proxy, and its default destination is a Mastra host.
The proxy is limited to loopback requests and rejects cross-origin requests.
The package has no install lifecycle hook in its scripts.
The other reviewed process execution is associated with lockfile generation or validation of a supplied file.

Behavioral surface

Source

Source & flagged code

7 flagged

dist/utils-O98BGdnP.cjsView file

Lines 1-21javascript

1require("child_process");

2require("fs");

High

Child Process

Package source references child process execution.

dist/utils-O98BGdnP.cjsView on unpkg · L1

3let path = require("path");

4let module$1 = require("module");

5//#region src/build/utils.ts

6/**

7* Get nodeResolve plugin options based on the target platform.

9* For 'browser' platform (e.g., Cloudflare Workers), uses browser-compatible

10* export conditions so packages like the Cloudflare SDK resolve to their

11* web runtime instead of Node.js-specific code.

12*

13* For 'node' and 'neutral' (Bun) platforms, uses Node.js module resolution.

14*/

15function getNodeResolveOptions(platform) {

16 if (platform === "browser") return {

17 preferBuiltins: false,

18 browser: true,

19 exportConditions: [

20 "browser",

21 "worker",

dist/analyze-z37DoML5.jsView file

Lines 322-362javascript

322 import.meta.resolve("@mastra/deployer/loader"),

323 "--input-type=module",

324 "--enable-source-maps",

325 "-e",

326 `${prefixCode};import('${

dist/validator/custom-resolver.cjsView file

Lines 1-21javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

2const require_utils = require("../utils-O98BGdnP.cjs");

3let fs = require("fs");

dist/analyze-IM-jyN5x.cjsView file

Lines 1-24javascript

1const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");

2const require_utils = require("./utils-O98BGdnP.cjs");

3const require_services =

dist/bundler/index.jsView file

Lines 240-280javascript

240 pnpmNodeLinker: this.pnpmNodeLinker

241 });

242 }

243 /**

244 * Generate a package-lock.json for the output directory so that deploy targets

245 * can use `npm ci` instead of `npm install`, skipping version resolution entirely.

246 * This is a lockfile-only operation — no packages are downloaded.

247 *

248 * Temporarily moves node_modules out of the way because pnpm's symlink-based

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/server/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/deployer@1.66.0 matchedIdentity = npm:QG1hc3RyYS9kZXBsb3llcg:1.66.0 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/utils-O98BGdnP.cjsView file

1require("child_process"); L2: require("fs");

High

Child Process

Package source references child process execution.

dist/utils-O98BGdnP.cjsView on unpkg · L1

dist/analyze-z37DoML5.jsView file

342"#tools", L343: "execa", L344: "effect",

High

Shell

Package source references shell execution.

dist/analyze-z37DoML5.jsView on unpkg · L342

dist/validator/custom-resolver.cjsView file

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" }); L2: const require_utils = require("../utils-O98BGdnP.cjs"); L3: let fs = require("fs");

Findings

1 Critical5 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/server/index.js

HighChild Processdist/utils-O98BGdnP.cjs

HighShelldist/analyze-z37DoML5.js

HighCross File Remote Execution Contextdist/analyze-IM-jyN5x.cjs

HighRuntime Package Installdist/bundler/index.js

HighSemantic Analysis Limitedpackage.json

MediumDynamic Requiredist/validator/custom-resolver.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mastra/deployer@1.63.0.

See all versions of @mastra/deployer for other recorded verdicts.

Review the evidence and your use of @mastra/deployer@1.63.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 06:34:23.788Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code