@mastra/e2b@0.14.1

⚠ Under review

E2B cloud sandbox provider for Mastra workspaces

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 209 KB of source, external domains: api.github.com, github.com, nodejs.org, packages.cloud.google.com, packages.microsoft.com

Source & flagged code

1 flagged

dist/index.jsView file

Lines 1-23javascript

1import { FactorySandbox, MastraSandbox, ProcessHandle, SandboxError, SandboxNotReadyError, SandboxProcessManager, UnsupportedStdinCloseError, assertModesUnsupported } from "@mastra/core/workspace";

2import { ApiClient, ConnectionConfig, Sandbox, Template } from "e2b";

3import { createHash } from "crypto";

4import { execFile } from "child_process";

5import { promisify } from "util";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L3

6import { FRAME_PREFIX, buildProgramModule, buildRunner, sanitizeToolId } from "@mastra/core/tools";

7import { transformSync } from "esbuild";

8/**

9* Node.js version installed into the default template — the current LTS at

10* pin time. An exact version rather than an `lts` alias so the template's

11* contents can never drift under a stable identity hash; bump deliberately

12* (each bump builds new templates).

13*/

14const DEFAULT_NODE_VERSION = "24.20.0";

15const NODE_VERSION_PATTERN = /^\d+\.\d+\.\d+$/;

16function isNamedTemplateSpec(spec) {

17 return typeof spec === "object" && spec !== null && "ref" in spec && "template" in spec;

18}

19function isDeferredNamedTemplateSpec(spec) {

20 return typeof spec === "object" && spec !== null && "resolveSpec" in spec && typeof spec.resolveSpec === "function";

21}

22/**

23* Create a base template with FUSE mounting dependencies pre-installed.

Source & flagged code

1 flagged · loading source

dist/index.jsView file

3import { createHash } from "crypto"; L4: import { execFile } from "child_process"; L5: import { promisify } from "util"; ... L66: return { L67: template: Template().fromTemplate("base").aptInstall(aptPackages).runCmd(`sudo rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack && curl -fsSL https://nod... L68: id: `mastra-${hash}`, ... L142: if (config.endpoint) validateEndpoint(config.endpoint); L143: if ((await sandbox.commands.run("which s3fs || echo \"not found\"")).stdout.includes("not found")) { L144: logger.warn(`${LOG_PREFIX} s3fs not found, attempting runtime installation...`); ... L190: try { L191: await sandbox.files.write(credentialsPath, credentialsContent); L192: await sandbox.commands.run(`chmod 600 ${credentialsPath}`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L3

Findings

2 Medium4 Low

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/index.js

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mastra/e2b@0.14.1.

See all versions of @mastra/e2b for other recorded verdicts.

Review the evidence and your use of @mastra/e2b@0.14.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 23:13:04.373Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code