@mastra/s3@0.6.4
S3-compatible filesystem provider for Mastra workspaces (AWS S3, Cloudflare R2, MinIO)
AI Security Review
scanned 2d ago · by lpm-firewall-aiSource inspection found an S3 storage adapter backed by the declared AWS SDK dependency, with no install hook or confirmed unrelated recipient. The scanner's generated SDK paths are consistent with normal S3 commands, pagination, waiters, and runtime configuration.
Decision evidence
public snapshot- The manifest identifies an S3-compatible filesystem provider, declares the AWS S3 client dependency, and has no install lifecycle hook. The required SDK files expose S3 commands, pagination, waiters, endpoint configuration, and runtime exports.
- The runtime uses caller-supplied credentials and the S3 client for filesystem operations; no unrelated recipient or confirmed attack behavior was identified.
Source & flagged code
8 flagged · loading sourceThe manifest identifies an S3-compatible filesystem provider, declares the AWS S3 client dependency, and has no install lifecycle hook. The required SDK files expose S3 commands, pagination, waiters, endpoint configuration, and runtime exports.
package.jsonView on unpkg · L1The manifest identifies an S3-compatible filesystem provider, declares the AWS S3 client dependency, and has no install lifecycle hook. The required SDK files expose S3 commands, pagination, waiters, endpoint configuration, and runtime exports.
Findings
Affected versions and remediation
This report applies to @mastra/s3@0.6.4.
See all versions of @mastra/s3 for other recorded verdicts.
- Review the evidence and your use of @mastra/s3@0.6.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.