registry / @mastra/deployer / 1.63.2

@mastra/deployer@1.63.2

⚠ Under review

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 1.08 MB of source, external domains: agentskills.io, cdnjs.cloudflare.com, developer.mozilla.org, github.com, json-schema.org, mastra.ai, output.signals.mastra.ai, tools.ietf.org

Source & flagged code

6 flagged

dist/utils-O98BGdnP.cjsView file

Lines 1-21javascript

1require("child_process");

2require("fs");

High

Child Process

Package source references child process execution.

dist/utils-O98BGdnP.cjsView on unpkg · L1

3let path = require("path");

4let module$1 = require("module");

5//#region src/build/utils.ts

6/**

7* Get nodeResolve plugin options based on the target platform.

9* For 'browser' platform (e.g., Cloudflare Workers), uses browser-compatible

10* export conditions so packages like the Cloudflare SDK resolve to their

11* web runtime instead of Node.js-specific code.

12*

13* For 'node' and 'neutral' (Bun) platforms, uses Node.js module resolution.

14*/

15function getNodeResolveOptions(platform) {

16 if (platform === "browser") return {

17 preferBuiltins: false,

18 browser: true,

19 exportConditions: [

20 "browser",

21 "worker",

dist/analyze-z37DoML5.jsView file

Lines 322-362javascript

322 import.meta.resolve("@mastra/deployer/loader"),

323 "--input-type=module",

324 "--enable-source-maps",

325 "-e",

326 `${prefixCode};import('${

dist/validator/custom-resolver.cjsView file

Lines 1-21javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

2const require_utils = require("../utils-O98BGdnP.cjs");

3let fs = require("fs");

dist/analyze-IM-jyN5x.cjsView file

Lines 1-24javascript

1const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");

2const require_utils = require("./utils-O98BGdnP.cjs");

3const require_services =

dist/bundler/index.jsView file

Lines 240-280javascript

240 pnpmNodeLinker: this.pnpmNodeLinker

241 });

242 }

243 /**

244 * Generate a package-lock.json for the output directory so that deploy targets

245 * can use `npm ci` instead of `npm install`, skipping version resolution entirely.

246 * This is a lockfile-only operation — no packages are downloaded.

247 *

248 * Temporarily moves node_modules out of the way because pnpm's symlink-based

dist/bundler-EFi87w8T.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/deployer@1.57.0 matchedIdentity = npm:QG1hc3RyYS9kZXBsb3llcg:1.57.0 similarity = 0.765 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bundler-EFi87w8T.cjsView on unpkg

Source & flagged code

6 flagged · loading source

dist/utils-O98BGdnP.cjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code