registry / @mastra/server / 1.56.0

@mastra/server@1.56.0

Static Scan Results

scanned 27d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 252 file(s), 8.19 MB of source, external domains: ai-gateway.vercel.sh, api.anthropic.com, api.duckduckgo.com, api.groq.com, api.open-meteo.com, api.openai.com, api.x.ai, datatracker.ietf.org, ecma-international.org, example.com, gateway-api.mastra.ai, generativelanguage.googleapis.com, geocoding-api.open-meteo.com, git.io, github.com, json-schema.org, lodash.com, mastra.ai, mths.be, openjsf.org, raw.githubusercontent.com, skills-api-production.up.railway.app, underscorejs.org, vercel.com, www.w3.org

Source & flagged code

3 flagged

dist/schema-Bv9OdW1f-BY6u3u8K.cjsView file

Lines 3832-3872javascript

3832 } : { ref: sch.schema }),

3833 validateName,

3834 ValidationError: _ValidationError,

3835 schema: sch.schema,

3836 schemaEnv: sch,

3837 rootId,

3838 baseId: sch.baseId || rootId,

3839 schemaPath: codegen_1.nil,

3840 errSchemaPath: sch.schemaPath || (this.opts.jtd ? "" : "#"),

3841 errorPath: (0, codegen_1._)`""`,

3842 opts: this.opts,

3843 self: this

3844 };

3845 let sourceCode;

3846 try {

3847 this._compilations.add(sch);

3848 (0, validate_1.validateFunctionCode)(schemaCxt);

3849 gen.optimize(this.opts.code.optimize);

3850 const validateCode = gen.toString();

3851 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${validateCode}`;

3852 if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch);

3853 const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());

3854 this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schema-Bv9OdW1f-BY6u3u8K.cjsView on unpkg · L3852

3855 validate.errors = null;

3856 validate.schema = sch.schema;

3857 validate.schemaEnv = sch;

3858 if (sch.$async) validate.$async = true;

3859 if (this.opts.code.source === true) validate.source = {

3860 validateName,

3861 validateCode,

3862 scopeValues: gen._values

3863 };

3864 if (this.opts.unevaluated) {

3865 const { props, items } = schemaCxt;

3866 validate.evaluated = {

3867 props: props instanceof codegen_1.Name ? void 0 : props,

3868 items: items instanceof codegen_1.Name ? void 0 : items,

3869 dynamicProps: props instanceof codegen_1.Name,

3870 dynamicItems: items instanceof codegen_1.Name

3871 };

3872 if (validate.source) validate.source.evaluated = (0, codegen_1.stringify)(validate.evaluated);

dist/schema-BieM1qrc.cjsView file

Lines 1-2javascript

1require("./schema-Bv9OdW1f-BY6u3u8K.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/schema-BieM1qrc.cjsView on unpkg · L1

dist/dist-Epz-mpJn.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/server@1.57.0 matchedIdentity = npm:QG1hc3RyYS9zZXJ2ZXI:1.57.0 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-Epz-mpJn.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/schema-Bv9OdW1f-BY6u3u8K.cjsView file

3852if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L3853: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L3854: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schema-Bv9OdW1f-BY6u3u8K.cjsView on unpkg · L3852

dist/schema-BieM1qrc.cjsView file

1require("./schema-Bv9OdW1f-BY6u3u8K.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/schema-BieM1qrc.cjsView on unpkg · L1

dist/dist-Epz-mpJn.jsView file

Findings

1 High4 Medium6 Low

HighPrevious Version Dangerous Deltadist/dist-Epz-mpJn.js

MediumDynamic Requiredist/schema-BieM1qrc.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/schema-Bv9OdW1f-BY6u3u8K.cjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings