@mastra/inngest@1.9.0

Mastra Inngest integration

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 5 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

Crypto

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 6 file(s), 237 KB of source

Source & flagged code

2 flagged

package.jsonView file

Lines 11-51json

11 "exports": {

12 ".": {

13 "import": {

14 "types": "./dist/index.d.ts",

15 "default": "./dist/index.js"

16 },

17 "require": {

18 "types": "./dist/index.d.ts",

19 "default": "./dist/index.cjs"

20 }

21 },

22 "./connect": {

23 "import": {

24 "types": "./dist/connect.d.ts",

25 "default": "./dist/connect.js"

26 },

27 "require": {

28 "types": "./dist/connect.d.ts",

29 "default": "./dist/connect.cjs"

30 }

31 },

32 "./package.json": "./package.json"

33 },

34 "dependencies": {

35 "@opentelemetry/api": "^1.9.1",

36 "inngest": "^4.5.0"

37 },

38 "devDependencies": {

39 "@ai-sdk/openai": "^1.3.24",

40 "@hono/node-server": "^2.0.0",

41 "@koa/router": "^13.1.1",

42 "@types/express": "^5.0.6",

43 "@types/koa": "^3.0.1",

44 "@types/koa-bodyparser": "^4.3.13",

45 "@types/node": "22.20.1",

46 "@vitest/coverage-v8": "4.1.11",

47 "@vitest/ui": "4.1.11",

48 "ai": "^4.3.19",

49 "eslint": "^10.7.0",

50 "execa": "^9.6.1",

51 "express": "^5.2.1",

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

package.jsonView on unpkg · L31

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/inngest@1.8.11 matchedIdentity = npm:QG1hc3RyYS9pbm5nZXN0:1.8.11 similarity = 0.444 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

31Manifest entrypoint (manifest.exports) carries capability families absent from dist/build output: execution+network L31: }, L32: "./package.json": "./package.json" L33: }, ... L49: "eslint": "^10.7.0", L50: "execa": "^9.6.1", L51: "express": "^5.2.1", ... L74: }, L75: "homepage": "https://mastra.ai", L76: "repository": {

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

package.jsonView on unpkg · L31

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

package.jsonView on unpkg

Findings

2 High1 Medium2 Low

HighEntrypoint Build Divergencepackage.json

HighPrevious Version Dangerous Deltapackage.json

MediumStructural Risk Force Deep Review

LowScripts Present

LowNo License

Affected versions and remediation

This report applies to @mastra/inngest@1.9.0.

See all versions of @mastra/inngest for other recorded verdicts.

Review the evidence and your use of @mastra/inngest@1.9.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 11:05:49.260Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code