registry / @mastra/e2b / 0.14.0
@mastra/e2b@0.14.0
⚠ Under reviewE2B cloud sandbox provider for Mastra workspaces
Static Scan Results
scanned 9d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
1 flagged · loading sourcedist/index.jsView file
3import { createHash } from "crypto";
L4: import { execFile } from "child_process";
L5: import { promisify } from "util";
...
L66: return {
L67: template: Template().fromTemplate("base").aptInstall(aptPackages).runCmd(`sudo rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack && curl -fsSL https://nod...
L68: id: `mastra-${hash}`,
...
L142: if (config.endpoint) validateEndpoint(config.endpoint);
L143: if ((await sandbox.commands.run("which s3fs || echo \"not found\"")).stdout.includes("not found")) {
L144: logger.warn(`${LOG_PREFIX} s3fs not found, attempting runtime installation...`);
...
L190: try {
L191: await sandbox.files.write(credentialsPath, credentialsContent);
L192: await sandbox.commands.run(`chmod 600 ${credentialsPath}`);
Low
Findings
2 Medium4 Low
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/index.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/e2b@0.14.0.
See all versions of @mastra/e2b for other recorded verdicts.
- Review the evidence and your use of @mastra/e2b@0.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.