registry / @mastra/e2b / 0.12.1
@mastra/e2b@0.12.1
E2B cloud sandbox provider for Mastra workspaces
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
2 flagged · loading sourcedist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @mastra/e2b@0.11.0
matchedIdentity = npm:QG1hc3RyYS9lMmI:0.11.0
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg3import { createHash, randomBytes } from "crypto";
L4: import { execFile } from "child_process";
L5: import { promisify } from "util";
...
L66: return {
L67: template: Template().fromTemplate("base").aptInstall(aptPackages).runCmd(`curl -fsSL https://nodejs.org/dist/v${nodeVersion}/node-v${nodeVersion}-linux-x64.tar.gz | sudo tar -xz -C...
L68: id: `mastra-${hash}`,
...
L142: if (config.endpoint) validateEndpoint(config.endpoint);
L143: if ((await sandbox.commands.run("which s3fs || echo \"not found\"")).stdout.includes("not found")) {
L144: logger.warn(`${LOG_PREFIX} s3fs not found, attempting runtime installation...`);
...
L168: await sandbox.commands.run(`sudo rm -f ${credentialsPath}`);
L169: await sandbox.files.write(credentialsPath, credentialsContent);
L170: await sandbox.command
Low
Findings
1 High2 Medium4 Low
HighPrevious Version Dangerous Deltadist/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/index.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/e2b@0.12.1.
See all versions of @mastra/e2b for other recorded verdicts.
- Review the evidence and your use of @mastra/e2b@0.12.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.