@mastra/koa@1.7.23
⚠ Under reviewMastra Koa adapter for the server
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe inspected manifest and entrypoint show no install hook or concrete attack behavior. Because required @mastra/server source is unresolved and its imported code is part of the runtime entrypoint, the package cannot be cleared from this snapshot.
Decision evidence
public snapshot- The manifest declares @mastra/server as a required runtime dependency.
- The entrypoint imports authentication and server-adapter code from @mastra/server, whose source was unresolved in the supplied snapshot.
- The visible @fastify/busboy dependency implements multipart and form parsing.
- The manifest lists no install lifecycle hook.
- The inspected parser dependency exposes a Busboy stream parser and has no install script in its manifest.
Source & flagged code
5 flagged · loading sourceThe manifest declares @mastra/server as a required runtime dependency.
package.jsonView on unpkg · L22The manifest declares @mastra/server as a required runtime dependency.
package.jsonView on unpkg · L66The entrypoint imports authentication and server-adapter code from @mastra/server, whose source was unresolved in the supplied snapshot.
Findings
Affected versions and remediation
This report applies to @mastra/koa@1.7.23.
See all versions of @mastra/koa for other recorded verdicts.
- Review the evidence and your use of @mastra/koa@1.7.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.