@mastra/server: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

3 flagged

dist/chunk-2ONW75MN.cjsView file

Lines 67-107javascript

67 if (!canRemove || canAdd && removePath.oldPos < addPath.oldPos) {

68 basePath = this.addToPath(addPath, true, false, 0, options);

69 } else {

70 basePath = this.addToPath(removePath, false, true, 1, options);

71 }

72 newPos = this.extractCommon(basePath, newTokens, oldTokens, diagonalPath, options);

73 if (basePath.oldPos + 1 >= oldLen && newPos + 1 >= newLen) {

74 return done(this.buildValues(basePath.lastComponent, newTokens, oldTokens)) || true;

75 } else {

76 bestPath[diagonalPath] = basePath;

77 if (basePath.oldPos + 1 >= oldLen) {

78 maxDiagonalToConsider = Math.min(maxDiagonalToConsider, diagonalPath - 1);

79 }

80 if (newPos + 1 >= newLen) {

81 minDiagonalToConsider = Math.max(minDiagonalToConsider, diagonalPath + 1);

82 }

83 }

84 }

85 editLength++;

86 };

87 if (callback) {

88 (function exec() {

89 setTimeout(function() {

High

Child Process

Package source references child process execution.

dist/chunk-2ONW75MN.cjsView on unpkg · L87

90 if (editLength > maxEditLength || Date.now() > abortAfterTimestamp) {

91 return callback(void 0);

92 }

93 if (!execEditLength()) {

94 exec();

95 }

96 }, 0);

97 })();

98 } else {

99 while (editLength <= maxEditLength && Date.now() <= abortAfterTimestamp) {

100 const ret = execEditLength();

101 if (ret) {

102 return ret;

103 }

104 }

105 }

106 }

107 addToPath(path, added, removed, oldPosInc, options) {

dist/chunk-22EM2GBH.cjsView file

Lines 2968-3008javascript

2968 validateName,

2969 ValidationError: _ValidationError,

2970 schema: sch.schema,

2971 schemaEnv: sch,

2972 rootId,

2973 baseId: sch.baseId || rootId,

2974 schemaPath

dist/dist-JSC2CQVL.jsView file

Lines 2748-2788javascript

2748 errors.push({

2749 type: "typescript",

2750 severity: diagnostic.category === ts.DiagnosticCategory.Warning ? "warning" : "error",

2751 message: ts.flattenDiagnosticMessageText(diagnostic.messageText, "\n

Source & flagged code

3 flagged · loading source

dist/chunk-2ONW75MN.cjsView file

87if (callback) { L88: (function exec() { L89: setTimeout(function() {

High

Child Process

Package source references child process execution.

dist/chunk-2ONW75MN.cjsView on unpkg · L87

dist/chunk-22EM2GBH.cjsView file

2988sourceCode = this.opts.code.process(sourceCode, sch); L2989: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2990: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-22EM2GBH.cjsView on unpkg · L2988

dist/dist-JSC2CQVL.jsView file

2768try { L2769: const { stdout } = await execFile("npx", ["eslint", filePath, "--format", "json"], { cwd: projectPath }); L2770: if (stdout) {

@mastra/server: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

3 flagged

dist/chunk-2ONW75MN.cjsView file

Lines 67-107javascript

67 if (!canRemove || canAdd && removePath.oldPos < addPath.oldPos) {

68 basePath = this.addToPath(addPath, true, false, 0, options);

69 } else {

70 basePath = this.addToPath(removePath, false, true, 1, options);

71 }

72 newPos = this.extractCommon(basePath, newTokens, oldTokens, diagonalPath, options);

73 if (basePath.oldPos + 1 >= oldLen && newPos + 1 >= newLen) {

74 return done(this.buildValues(basePath.lastComponent, newTokens, oldTokens)) || true;

75 } else {

76 bestPath[diagonalPath] = basePath;

77 if (basePath.oldPos + 1 >= oldLen) {

78 maxDiagonalToConsider = Math.min(maxDiagonalToConsider, diagonalPath - 1);

79 }

80 if (newPos + 1 >= newLen) {

81 minDiagonalToConsider = Math.max(minDiagonalToConsider, diagonalPath + 1);

82 }

83 }

84 }

85 editLength++;

86 };

87 if (callback) {

88 (function exec() {

89 setTimeout(function() {

High

Child Process

Package source references child process execution.

dist/chunk-2ONW75MN.cjsView on unpkg · L87

90 if (editLength > maxEditLength || Date.now() > abortAfterTimestamp) {

91 return callback(void 0);

92 }

93 if (!execEditLength()) {

94 exec();

95 }

96 }, 0);

97 })();

98 } else {

99 while (editLength <= maxEditLength && Date.now() <= abortAfterTimestamp) {

100 const ret = execEditLength();

101 if (ret) {

102 return ret;

103 }

104 }

105 }

106 }

107 addToPath(path, added, removed, oldPosInc, options) {

dist/chunk-22EM2GBH.cjsView file

Lines 2968-3008javascript

2968 validateName,

2969 ValidationError: _ValidationError,

2970 schema: sch.schema,

2971 schemaEnv: sch,

2972 rootId,

2973 baseId: sch.baseId || rootId,

2974 schemaPath

dist/dist-JSC2CQVL.jsView file

Lines 2748-2788javascript

2748 errors.push({

2749 type: "typescript",

2750 severity: diagnostic.category === ts.DiagnosticCategory.Warning ? "warning" : "error",

2751 message: ts.flattenDiagnosticMessageText(diagnostic.messageText, "\n

@mastra/server@1.49.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code