registry / @mastra/schema-compat / 1.3.12

@mastra/schema-compat@1.3.12

Tool schema compatibility layer for Mastra.ai

Static Scan Results

scanned 23d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 4 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Eval

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 1.17 MB of source, external domains: json-schema.org, raw.githubusercontent.com

Source & flagged code

1 flagged

dist/json-schema-VSnKq6-P.cjsView file

Lines 2475-2515javascript

2475 } : { ref: sch.schema }),

2476 validateName,

2477 ValidationError: _ValidationError,

2478 schema: sch.schema,

2479 schemaEnv: sch,

2480 rootId,

2481 baseId: sch.baseId || rootId,

2482 schemaPath: codegen_1.nil,

2483 errSchemaPath: sch.schemaPath || (this.opts.jtd ? "" : "#"),

2484 errorPath: (0, codegen_1._)`""`,

2485 opts: this.opts,

2486 self: this

2487 };

2488 let sourceCode;

2489 try {

2490 this._compilations.add(sch);

2491 (0, validate_1.validateFunctionCode)(schemaCxt);

2492 gen.optimize(this.opts.code.optimize);

2493 const validateCode = gen.toString();

2494 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${validateCode}`;

2495 if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch);

2496 const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());

2497 this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/json-schema-VSnKq6-P.cjsView on unpkg · L2495

2498 validate.errors = null;

2499 validate.schema = sch.schema;

2500 validate.schemaEnv = sch;

2501 if (sch.$async) validate.$async = true;

2502 if (this.opts.code.source === true) validate.source = {

2503 validateName,

2504 validateCode,

2505 scopeValues: gen._values

2506 };

2507 if (this.opts.unevaluated) {

2508 const { props, items } = schemaCxt;

2509 validate.evaluated = {

2510 props: props instanceof codegen_1.Name ? void 0 : props,

2511 items: items instanceof codegen_1.Name ? void 0 : items,

2512 dynamicProps: props instanceof codegen_1.Name,

2513 dynamicItems: items instanceof codegen_1.Name

2514 };

2515 if (validate.source) validate.source.evaluated = (0, codegen_1.stringify)(validate.evaluated);

Source & flagged code

1 flagged · loading source

dist/json-schema-VSnKq6-P.cjsView file

2495if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L2496: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L2497: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/json-schema-VSnKq6-P.cjsView on unpkg · L2495

Findings

4 Low

LowScripts Present

LowEvaldist/json-schema-VSnKq6-P.cjs

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mastra/schema-compat@1.3.12.

See all versions of @mastra/schema-compat for other recorded verdicts.

Review the evidence and your use of @mastra/schema-compat@1.3.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-29 23:59:49.480Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code