registry / @mastra/e2b / 0.10.0
@mastra/e2b@0.10.0
E2B cloud sandbox provider for Mastra workspaces
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 5 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
CryptoEnvironmentVars
HighEntropyStringsUrlStrings
Source & flagged code
1 flagged · loading sourcedist/index.jsView file
115if (config.endpoint) validateEndpoint(config.endpoint);
L116: if ((await sandbox.commands.run("which s3fs || echo \"not found\"")).stdout.includes("not found")) {
L117: logger.warn(`${LOG_PREFIX} s3fs not found, attempting runtime installation...`);
...
L141: await sandbox.commands.run(`sudo rm -f ${credentialsPath}`);
L142: await sandbox.files.write(credentialsPath, credentialsContent);
L143: await sandbox.commands.run(`chmod 600 ${credentialsPath}`);
...
L203: const codename = (await sandbox.commands.run("lsb_release -cs 2>/dev/null || echo jammy")).stdout.trim() || "jammy";
L204: await sandbox.commands.run(`curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/gcsfuse.gpg && echo "deb [signed-by=/etc/apt/...
L205: }
...
L394: if
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/index.jsView on unpkg · L115Findings
1 Medium4 Low
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/index.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/e2b@0.10.0.
See all versions of @mastra/e2b for other recorded verdicts.
- Review the evidence and your use of @mastra/e2b@0.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.