@mastra/gcs@0.3.4

Google Cloud Storage filesystem provider for Mastra workspaces

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The package has no install hook in its manifest, and its runtime source implements caller-directed storage operations using the Google Cloud Storage client. The inspected dependency entrypoints expose the expected storage API; no independent attack behavior was found.

Static reason

No blocking static signals were detected.

Trigger

A caller constructs or uses the exported filesystem provider.

Impact

Operations affect the configured storage bucket; the inspected source shows no separate collection or transmission of credentials.

Mechanism

The adapter passes caller-supplied credentials and an optional endpoint to the Google Cloud Storage client for bucket operations.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package manifest exposes a Google Cloud Storage filesystem and its scripts contain no preinstall, install, or postinstall hook.
The filesystem takes credentials and an optional API endpoint from caller-provided options, then passes them to the Google Cloud Storage client.
The inspected dependency manifest identifies the expected Google Cloud Storage client; its prepare script runs compilation.
The dependency’s CommonJS and ESM entrypoints export the Storage client and related storage modules.

Evidence against

Behavioral surface

Source

Filesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 30.4 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 1-21json

2 "name": "@mastra/gcs",

3 "version": "0.3.4",

4 "description": "Google Cloud Storage filesystem provider for Mastra workspaces",

5 "type": "module",

6 "main": "dist/index.js",

7 "types": "dist/index.d.ts",

Low

Suspicious Lifecycle Evidence

The package manifest exposes a Google Cloud Storage filesystem and its scripts contain no preinstall, install, or postinstall hook.

package.jsonView on unpkg · L1

8 "exports": {

9 ".": {

10 "import": {

11 "types": "./dist/index.d.ts",

12 "default": "./dist/index.js"

13 },

14 "require": {

15 "types": "./dist/index.d.ts",

16 "default": "./dist/index.cjs"

17 }

18 },

19 "./package.json": "./package.json"

20 },

21 "license": "Apache-2.0",

Lines 36-69json

36 "@internal/workspace-test-utils": "0.0.89"

37 },

38 "peerDependencies": {

39 "@mastra/core": ">=1.4.0-0 <2.0.0-0"

40 },

41 "files": [

42 "dist"

43 ],

44 "homepage"

dist/index.jsView file

Lines 110-150javascript

110 readOnly;

111 status = "pending";

112 displayName;

113 icon = "gcs";

114 description;

115 bucketName;

116 projectId;

117 credentials;

118 prefix;

.lpm-dependency-evidence-6c6bf409-af4d-438e-8670-1d553ea0ebde/0/npm-linux/package.jsonView file

1{ "name": "@google-cloud/storage", "description": "Cloud Storage Client Library for Node.js", "version": "7.22.0", "license": "Apache-2.0", "author": "Google Inc.", "engines": { "node": ">=18" }, "repository": { "type": "git", "directory": "handwritten/storage", "url": "https://github.com/googleapis/google-cloud-node.git" }, "main": "./build/cjs/src/index.js",

Low

Suspicious Dependency Evidence

The inspected dependency manifest identifies the expected Google Cloud Storage client; its prepare script runs compilation.

.lpm-dependency-evidence-6c6bf409-af4d-438e-8670-1d553ea0ebde/0/npm-linux/package.jsonView on unpkg · L1

67"prepare": "npm run compile", "presystem-test:esm": "npm run compile:esm", "presystem-test": "npm run compile -- --sourceMap", "pretest": "npm run compile -- --sourceMa

Low

Suspicious Dependency Evidence

The inspected dependency manifest identifies the expected Google Cloud Storage client; its prepare script runs compilation.

.lpm-dependency-evidence-6c6bf409-af4d-438e-8670-1d553ea0ebde/0/npm-linux/package.jsonView on unpkg · L67

.lpm-dependency-evidence-6c6bf409-af4d-438e-8670-1d553ea0ebde/0/npm-linux/build/cjs/src/index.jsView file

77var storage_js_1 = require("./storage.js"); Object.defineProperty(exports, "IdempotencyStrategy", { enumerable: true, get: function () { return storage_js_1.IdempotencyStrategy; }

Low

Suspicious Dependency Evidence

The dependency’s CommonJS and ESM entrypoints export the Storage client and related storage modules.

.lpm-dependency-evidence-6c6bf409-af4d-438e-8670-1d553ea0ebde/0/npm-linux/build/cjs/src/index.jsView on unpkg · L77

.lpm-dependency-evidence-6c6bf409-af4d-438e-8670-1d553ea0ebde/0/npm-linux/build/esm/src/index.jsView file

59export { IdempotencyStrategy, RETRYABLE_ERR_FN_DEFAULT, Storage, } from './storage.js'; export { Bucket, ComposeCleanupError, } from './bucket.js'; export * from './crc32c.js'; exp

Low

Suspicious Dependency Evidence

The dependency’s CommonJS and ESM entrypoints export the Storage client and related storage modules.

.lpm-dependency-evidence-6c6bf409-af4d-438e-8670-1d553ea0ebde/0/npm-linux/build/esm/src/index.jsView on unpkg · L59

Source & flagged code

8 flagged · loading source

package.jsonView file

1{ "name": "@mastra/gcs", "version": "0.3.4", "description": "Google Cloud Storage filesystem provider for Mastra workspaces", "type": "module", "main": "dist/index.js",

Low

Suspicious Lifecycle Evidence

The package manifest exposes a Google Cloud Storage filesystem and its scripts contain no preinstall, install, or postinstall hook.

package.jsonView on unpkg · L1

56"scripts": { "build": "tsdown --silent --config tsdown.config.ts", "build:lib": "pnpm build", "build:watch": "pnpm build --watch", "test:unit": "vitest run --exclude '**/*.integration.test.ts'", "test:watch": "vitest watch", "pretest": "docker compose up -d && sleep 3", "test": "GCS_ENDPOINT=http://localhost:4443 TEST_GCS_BUCKET=test-bucket vitest run ./src/**/*.integration.test.ts", "posttest": "docker compose down -v", "test:cloud": "vitest run ./src/**/*.integration.test.ts", "lint": "oxlint --type-aware .", "lint:fix": "oxlint --type-aware --fi

Low

Suspicious Lifecycle Evidence

The package manifest exposes a Google Cloud Storage filesystem and its scripts contain no preinstall, install, or postinstall hook.

package.jsonView on unpkg · L56

dist/index.jsView file

Findings

10 Low

LowScripts Present

LowFilesystem

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

LowSuspicious Dependency Evidence.lpm-dependency-evidence-6c6bf409-af4d-438e-8670-1d553ea0ebde/0/npm-linux/package.json

LowSuspicious Dependency Evidence.lpm-dependency-evidence-6c6bf409-af4d-438e-8670-1d553ea0ebde/0/npm-linux/build/cjs/src/index.js

LowSuspicious Dependency Evidence.lpm-dependency-evidence-6c6bf409-af4d-438e-8670-1d553ea0ebde/0/npm-linux/build/esm/src/index.js

Affected versions and remediation

This report applies to @mastra/gcs@0.3.4.

See all versions of @mastra/gcs for other recorded verdicts.

Review the evidence and your use of @mastra/gcs@0.3.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 12:04:58.227Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code