@mastra/server@1.47.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@mastra/server@1.47.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

3 flagged

dist/chunk-3YQ7NWF6.cjsView file

Lines 2968-3008javascript

2968 validateName,

2969 ValidationError: _ValidationError,

2970 schema: sch.schema,

2971 schemaEnv: sch,

2972 rootId,

2973 baseId: sch.baseId || rootId,

2974 schemaPath: codegen_1.nil,

2975 errSchemaPath: sch.schemaPath || (this.opts.jtd ? "" : "#"),

2976 errorPath: (0, codegen_1._)`""`,

2977 opts: this.opts,

2978 self: this

2979 };

2980 let sourceCode;

2981 try {

2982 this._compilations.add(sch);

2983 (0, validate_1.validateFunctionCode)(schemaCxt);

2984 gen.optimize(this.opts.code.optimize);

2985 const validateCode = gen.toString();

2986 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${validateCode}`;

2987 if (this.opts.code.process)

2988 sourceCode = this.opts.code.process(sourceCode, sch);

2989 const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);

2990 const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-3YQ7NWF6.cjsView on unpkg · L2988

2991 this.scope.value(validateName, { ref: validate });

2992 validate.errors = null;

2993 validate.schema = sch.schema;

2994 validate.schemaEnv = sch;

2995 if (sch.$async)

2996 validate.$async = true;

2997 if (this.opts.code.source === true) {

2998 validate.source = { validateName, validateCode, scopeValues: gen._values };

2999 }

3000 if (this.opts.unevaluated) {

3001 const { props, items } = schemaCxt;

3002 validate.evaluated = {

3003 props: props instanceof codegen_1.Name ? void 0 : props,

3004 items: items instanceof codegen_1.Name ? void 0 : items,

3005 dynamicProps: props instanceof codegen_1.Name,

3006 dynamicItems: items instanceof codegen_1.Name

3007 };

3008 if (validate.source)

dist/dist-VNWFQ5X6.cjsView file

•path = dist/dist-VNWFQ5X6.cjs kind = oversized_source_file sizeBytes = 2143588 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-VNWFQ5X6.cjsView on unpkg

dist/chunk-43T7OG7P.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/server@1.48.0 matchedIdentity = npm:QG1hc3RyYS9zZXJ2ZXI:1.48.0 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/chunk-43T7OG7P.jsView on unpkg