registry / @mastra/server / 1.48.0

@mastra/server@1.48.0

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 362 file(s), 8.80 MB of source, external domains: ai-gateway.vercel.sh, api.anthropic.com, api.duckduckgo.com, api.groq.com, api.open-meteo.com, api.openai.com, api.x.ai, gateway-api.mastra.ai, generativelanguage.googleapis.com, geocoding-api.open-meteo.com, git.io, github.com, json-schema.org, mastra.ai, mths.be, raw.githubusercontent.com, skills-api-production.up.railway.app, vercel.com, www.w3.org

Source & flagged code

3 flagged

dist/dist-6VCCDFCW.cjsView file

Lines 1-28javascript

1'use strict';

3var chunk2WUMO4RN_cjs = require('./chunk-2WUMO4RN.cjs');

4var chunkMRD47GBP_cjs = require('./chunk-MRD47GBP.cjs');

5var chunk3YQ7NWF6_cjs = require('./chunk-3YQ7NWF6.cjs');

6var chunkO7I5CWRX_cjs = require('./chunk-O7I5CWRX.cjs');

7var agent = require('@mastra/core/agent');

8var storage = require('@mastra/core/storage');

9var child_process = require('child_process');

10var promises = require('fs/promises');

High

Child Process

Package source references child process execution.

dist/dist-6VCCDFCW.cjsView on unpkg · L8

11var path = require('path');

12var tools = require('@mastra/core/tools');

13var zod = require('zod');

14var fs = require('fs');

15var module$1 = require('module');

16var util = require('util');

17var llm = require('@mastra/core/llm');

18var os = require('os');

19var schema = require('@mastra/core/schema');

20var workflows = require('@mastra/core/workflows');

21var z4 = require('zod/v4');

22var v3 = require('zod/v3');

24function _interopNamespace(e) {

25 if (e && e.__esModule) return e;

26 var n = Object.create(null);

27 if (e) {

28 Object.keys(e).forEach(function (k) {

Lines 2769-2809javascript

2769 errors.push({

2770 type: "typescript",

2771 severity: diagnostic.category === ts.DiagnosticCategory.Warning ? "warning" : "error",

2772 message: ts.flattenDiagnosticMessageText(diagnostic.messageText, "\n"),

2773 file: filePath,

dist/chunk-3YQ7NWF6.cjsView file

Lines 2968-3008javascript

2968 validateName,

2969 ValidationError: _ValidationError,

2970 schema: sch.schema,

2971 schemaEnv: sch,

2972 rootId,

2973 baseId: sch.baseId || rootId,

2974 schemaPath

Source & flagged code

3 flagged · loading source

dist/dist-6VCCDFCW.cjsView file

8var storage = require('@mastra/core/storage'); L9: var child_process = require('child_process'); L10: var promises = require('fs/promises');

High

Child Process

Package source references child process execution.

dist/dist-6VCCDFCW.cjsView on unpkg · L8

2789try { L2790: const { stdout } = await execFile("npx", ["eslint", filePath, "--format", "json"], { cwd: projectPath }); L2791: if (stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/dist-6VCCDFCW.cjsView on unpkg · L2789

dist/chunk-3YQ7NWF6.cjsView file

2988sourceCode = this.opts.code.process(sourceCode, sch); L2989: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2990: const validate = makeValidate(this, this.scope.get());

Low

Eval

Findings

3 High3 Medium6 Low

HighChild Processdist/dist-6VCCDFCW.cjs

HighShell

HighRuntime Package Installdist/dist-6VCCDFCW.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunk-3YQ7NWF6.cjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings