registry / @mastra/deployer / 1.78.0
@mastra/deployer@1.78.0
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the flagged execution paths are tied to explicit deployment or validation operations. The subprocess checks and project-file import are consistent with the package's stated role; the inspected source establishes no attack behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer invokes the deployer or analyzer functionality for a project.
Impact
No malicious package behavior or unintended data transfer was established.
Mechanism
Deployment subprocess arguments are constrained, and validation imports the supplied project file in a child Node process.
AI rationale
The manifest has no install lifecycle hook, and the flagged execution paths are tied to explicit deployment or validation operations. The subprocess checks and project-file import are consistent with the package's stated role; the inspected source establishes no attack behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists build, watch, OpenAPI, test, and lint scripts, with no install lifecycle hook.
- The subprocess wrapper rejects arguments outside a restricted character set before invoking a shell.
- The analyzer's validator runs when given a file and imports that file in a child Node process, consistent with validating a project entrypoint.
- The exported deployer helper receives an entry file and passes it to configuration extraction.
Evidence against
- The package uses shell subprocesses for deployment and dependency-management operations.
- The analyzer imports the supplied project file during validation; these are user-invoked development operations, not install-time package behavior.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcedist/services-DXqmEy8F.jsView file
6import fsExtra, { ensureFile, readJSON, writeJSON } from "fs-extra/esm";
L7: import { spawn } from "child_process";
L8: import { fileURLToPath } from "url";
High
Child Process
Package source references child process execution.
dist/services-DXqmEy8F.jsView on unpkg · L623/**
L24: * Args are joined into a shell command (`shell: true` is required for package
L25: * manager shims on Windows), so only allow characters that appear in package
High
dist/build-DGaVDFbz.cjsView file
1const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
L2: const require_analyze = require("./analyze-BfkDyBzU.cjs");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/analyze-BfkDyBzU.cjs
HighChild Processdist/services-DXqmEy8F.js
HighShelldist/services-DXqmEy8F.js
HighCross File Remote Execution Contextdist/analyze-BfkDyBzU.cjs
MediumDynamic Requiredist/build-DGaVDFbz.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @mastra/deployer@1.78.0.
See all versions of @mastra/deployer for other recorded verdicts.
- Review the evidence and your use of @mastra/deployer@1.78.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.