registry / @mastra/deployer / 1.65.0

@mastra/deployer@1.65.0

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 1.08 MB of source, external domains: agentskills.io, cdn.jsdelivr.net, cdnjs.cloudflare.com, json-schema.org, mastra.ai, output.signals.mastra.ai

Source & flagged code

6 flagged

dist/utils-O98BGdnP.cjsView file

Lines 1-21javascript

1require("child_process");

2require("fs");

High

Child Process

Package source references child process execution.

dist/utils-O98BGdnP.cjsView on unpkg · L1

3let path = require("path");

4let module$1 = require("module");

5//#region src/build/utils.ts

6/**

7* Get nodeResolve plugin options based on the target platform.

9* For 'browser' platform (e.g., Cloudflare Workers), uses browser-compatible

10* export conditions so packages like the Cloudflare SDK resolve to their

11* web runtime instead of Node.js-specific code.

12*

13* For 'node' and 'neutral' (Bun) platforms, uses Node.js module resolution.

14*/

15function getNodeResolveOptions(platform) {

16 if (platform === "browser") return {

17 preferBuiltins: false,

18 browser: true,

19 exportConditions: [

20 "browser",

21 "worker",

dist/analyze-z37DoML5.jsView file

Lines 322-362javascript

322 import.meta.resolve("@mastra/deployer/loader"),

323 "--input-type=module",

324 "--enable-source-maps",

325 "-e",

326 `${prefixCode};import('${

dist/validator/custom-resolver.cjsView file

Lines 1-21javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

2const require_utils = require("../utils-O98BGdnP.cjs");

3let fs = require("fs");

dist/analyze-IM-jyN5x.cjsView file

Lines 1-24javascript

1const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");

2const require_utils = require("./utils-O98BGdnP.cjs");

3const require_services =

dist/bundler/index.jsView file

Lines 240-280javascript

240 pnpmNodeLinker: this.pnpmNodeLinker

241 });

242 }

243 /**

244 * Generate a package-lock.json for the output directory so that deploy targets

245 * can use `npm ci` instead of `npm install`, skipping version resolution entirely.

246 * This is a lockfile-only operation — no packages are downloaded.

247 *

248 * Temporarily moves node_modules out of the way because pnpm's symlink-based

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

6 flagged · loading source

dist/utils-O98BGdnP.cjsView file

1require("child_process"); L2: require("fs");

High

Child Process

Package source references child process execution.

dist/utils-O98BGdnP.cjsView on unpkg · L1

dist/analyze-z37DoML5.jsView file

342"#tools", L343: "execa", L344: "effect",

High

Shell

Package source references shell execution.

dist/analyze-z37DoML5.jsView on unpkg · L342

dist/validator/custom-resolver.cjsView file

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" }); L2: const require_utils = require("../utils-O98BGdnP.cjs"); L3: let fs = require("fs");

Findings

5 High4 Medium4 Low

HighChild Processdist/utils-O98BGdnP.cjs

HighShelldist/analyze-z37DoML5.js

HighCross File Remote Execution Contextdist/analyze-IM-jyN5x.cjs

HighRuntime Package Installdist/bundler/index.js

HighSemantic Analysis Limitedpackage.json

MediumDynamic Requiredist/validator/custom-resolver.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mastra/deployer@1.65.0.

See all versions of @mastra/deployer for other recorded verdicts.

Review the evidence and your use of @mastra/deployer@1.65.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 00:49:32.892Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code