@mastra/google-cloud-pubsub@1.1.4
Mastra Google Cloud PubSub integration
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package manifest has no install lifecycle hook, and the inspected runtime performs Pub/Sub operations through its exported API using caller-provided configuration and topics. Required dependency excerpts show ordinary Pub/Sub and OpenTelemetry helper behavior; no concrete attack behavior was found.
Decision evidence
public snapshot- The manifest points to dist/index.js and lists only build, watch, test, and lint scripts; it declares no install lifecycle hook. The runtime class uses caller-provided configuration and topics for Google Cloud Pub/Sub, while the inspected dependency paths contain ordinary stream, protocol, context, logging, and no-op telemetry helpers.
Source & flagged code
8 flagged · loading sourceThe manifest points to dist/index.js and lists only build, watch, test, and lint scripts; it declares no install lifecycle hook. The runtime class uses caller-provided configuration and topics for Google Cloud Pub/Sub, while the inspected dependency paths contain ordinary stream, protocol, context, logging, and no-op telemetry helpers.
.lpm-dependency-evidence-f53415ce-1fad-47bd-a378-5d4bee3398d1/0/npm-linux/build/protos/protos.jsView on unpkg · L30Findings
Affected versions and remediation
This report applies to @mastra/google-cloud-pubsub@1.1.4.
See all versions of @mastra/google-cloud-pubsub for other recorded verdicts.
- Review the evidence and your use of @mastra/google-cloud-pubsub@1.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.