registry / @mastra/server / 1.58.0

@mastra/server@1.58.0

Static Scan Results

scanned 24d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 256 file(s), 8.20 MB of source, external domains: ai-gateway.vercel.sh, api.anthropic.com, api.duckduckgo.com, api.groq.com, api.open-meteo.com, api.openai.com, api.x.ai, datatracker.ietf.org, ecma-international.org, example.com, gateway-api.mastra.ai, generativelanguage.googleapis.com, geocoding-api.open-meteo.com, git.io, github.com, json-schema.org, lodash.com, mastra.ai, mths.be, openjsf.org, raw.githubusercontent.com, skills-api-production.up.railway.app, underscorejs.org, vercel.com, www.w3.org

Source & flagged code

5 flagged

dist/schema-Bv9OdW1f-DLSJSqQv.jsView file

Lines 3756-3796javascript

3756 } : { ref: sch.schema }),

3757 validateName,

3758 ValidationError: _ValidationError,

3759 schema: sch.schema,

3760 schemaEnv: sch,

3761 rootId,

3762 baseId: sch.baseId || rootId,

3763 schemaPath: codegen_1.nil,

3764 errSchemaPath: sch.schemaPath || (this.opts.jtd ? "" : "#"),

3765 errorPath: (0, codegen_1._)`""`,

3766 opts: this.opts,

3767 self: this

3768 };

3769 let sourceCode;

3770 try {

3771 this._compilations.add(sch);

3772 (0, validate_1.validateFunctionCode)(schemaCxt);

3773 gen.optimize(this.opts.code.optimize);

3774 const validateCode = gen.toString();

3775 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${validateCode}`;

3776 if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch);

3777 const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());

3778 this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schema-Bv9OdW1f-DLSJSqQv.jsView on unpkg · L3776

3779 validate.errors = null;

3780 validate.schema = sch.schema;

3781 validate.schemaEnv = sch;

3782 if (sch.$async) validate.$async = true;

3783 if (this.opts.code.source === true) validate.source = {

3784 validateName,

3785 validateCode,

3786 scopeValues: gen._values

3787 };

3788 if (this.opts.unevaluated) {

3789 const { props, items } = schemaCxt;

3790 validate.evaluated = {

3791 props: props instanceof codegen_1.Name ? void 0 : props,

3792 items: items instanceof codegen_1.Name ? void 0 : items,

3793 dynamicProps: props instanceof codegen_1.Name,

3794 dynamicItems: items instanceof codegen_1.Name

3795 };

3796 if (validate.source) validate.source.evaluated = (0, codegen_1.stringify)(validate.evaluated);

dist/channels-BRoq3VKR.cjsView file

Lines 1-21javascript

1const require_http_exception = require("./http-exception-CKDHupKw.cjs");

2const require_route_builder = require("./route-builder-BAAedfru.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/channels-BRoq3VKR.cjsView on unpkg · L1

dist/dist-DEgLyP8h.cjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/dist-DEgLyP8h.cjs: throw new Error("@vercel/oidc is not available in the vendored @internal AI packages. Provide an API key instead."); if (apiKeyProvided) contextualMessage = `AI Gateway authentication failed: Invalid API key. Create a new API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys Alternatively, use an API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys`; Option 1 - API key: Create an API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys url: `${this.config.baseURL}/config`, url: `${new URL(this.config.baseURL).origin}/v1/credits`,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/dist-DEgLyP8h.cjsView on unpkg

dist/dist-7r8jzEWH.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/dist-7r8jzEWH.js: import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs"; import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises"; //#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/async-mutex/0.5.[redacted]node_modules/async-mutex/... //#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/lru-cache/11.5.[redacted]node_modules/lru-cache/dis... //#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/xxhash-wasm/1.1.[redacted]node_modules/xxhash-wasm/... //#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/tok

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/dist-7r8jzEWH.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/server@1.57.0 matchedIdentity = npm:QG1hc3RyYS9zZXJ2ZXI:1.57.0 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-7r8jzEWH.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/schema-Bv9OdW1f-DLSJSqQv.jsView file

3776if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L3777: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L3778: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schema-Bv9OdW1f-DLSJSqQv.jsView on unpkg · L3776

dist/channels-BRoq3VKR.cjsView file

1const require_http_exception = require("./http-exception-CKDHupKw.cjs"); L2: const require_route_builder = require("./route-builder-BAAedfru.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/channels-BRoq3VKR.cjsView on unpkg · L1

dist/dist-DEgLyP8h.cjsView file

Findings

3 High4 Medium6 Low

HighCredential Redirect Persistencedist/dist-DEgLyP8h.cjs

HighEntrypoint Foreign Package Code Overwritedist/dist-7r8jzEWH.js

HighPrevious Version Dangerous Deltadist/dist-7r8jzEWH.js

MediumDynamic Requiredist/channels-BRoq3VKR.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/schema-Bv9OdW1f-DLSJSqQv.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings