@mastra/server@1.61.0

⚠ Under review

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The inspected source contradicts the scanner’s specific credential-redirect claim, but does not cover the full flagged runtime surface or required paths. Since the unresolved review scope is material, the source evidence is insufficient for a clean or malicious verdict.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The package-install helper runs when its install operation is invoked; gateway requests occur when a consumer uses that provider.

Impact

The available excerpts do not establish credential theft, unauthorized persistence, or another attack impact; unreviewed runtime paths prevent a clean determination.

Mechanism

The inspected code starts a package-manager command for requested package operations and sends gateway requests using gateway authentication. The examined source does not show an Anthropic key being redirected to the gateway.

AI rationale

Network endpoints2

ai-gateway.vercel.sh/v1/aiapi.anthropic.com/v1/messages/count_tokens

Decision evidence

public snapshot

AI called this Manual Review at 55.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest points to built entrypoints and shows build and development scripts; the inspected excerpt does not establish an install hook.
The gateway provider defaults to the Vercel AI Gateway and obtains its gateway authentication token for requests.
The inspected Anthropic token-estimation helper uses the Anthropic key and sends its request to Anthropic’s API.
A package-install helper spawns a package manager when its install operation is called.

Evidence against

The inspected excerpts do not substantiate the scanner’s claim that an Anthropic credential is sent to an unrelated gateway or that a redirect is persisted.
The runtime review remains incomplete: the flagged bundles and required runtime paths were not all traced.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

6 flagged

dist/dist-DERatX43.cjsView file

30let async_hooks = require("async_hooks"); L31: let child_process = require("child_process"); L32: let fs_promises = require("fs/promises");

High

Child Process

Package source references child process execution.

dist/dist-DERatX43.cjsView on unpkg · L30

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView file

Lines 3758-3798javascript

3758 } : { ref: sch.schema }),

3759 validateName,

3760 ValidationError: _ValidationError,

3761 schema: sch.schema,

3762 schemaEnv: sch,

3763 rootId,

3764 baseId: sch.baseId || rootId,

3765 schemaPath: codegen_1.nil,

3766 errSchemaPath: sch.schemaPath || (this.opts.jtd ? "" : "#"),

3767 errorPath: (0, codegen_1._)`""`,

3768 opts: this.opts,

3769 self: this

3770 };

3771 let sourceCode;

3772 try {

3773 this._compilations.add(sch);

3774 (0, validate_1.validateFunctionCode)(schemaCxt);

3775 gen.optimize(this.opts.code.optimize);

3776 const validateCode = gen.toString();

3777 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${validateCode}`;

3778 if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch);

3779 const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());

3780 this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView on unpkg · L3778

3781 validate.errors = null;

3782 validate.schema = sch.schema;

3783 validate.schemaEnv = sch;

3784 if (sch.$async) validate.$async = true;

3785 if (this.opts.code.source === true) validate.source = {

3786 validateName,

3787 validateCode,

3788 scopeValues: gen._values

3789 };

3790 if (this.opts.unevaluated) {

3791 const { props, items } = schemaCxt;

3792 validate.evaluated = {

3793 props: props instanceof codegen_1.Name ? void 0 : props,

3794 items: items instanceof codegen_1.Name ? void 0 : items,

3795 dynamicProps: props instanceof codegen_1.Name,

3796 dynamicItems: items instanceof codegen_1.Name

3797 };

3798 if (validate.source) validate.source.evaluated = (0, codegen_1.stringify)(validate.evaluated);

dist/dist-Cw-T1gX6.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/server@1.66.0 matchedIdentity = npm:QG1hc3RyYS9zZXJ2ZXI:1.66.0 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-Cw-T1gX6.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/dist-Cw-T1gX6.js: import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs"; import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises"; throw new Error("@vercel/oidc is not available in the vendored @internal AI packages. Provide an API key instead."); if (apiKeyProvided) contextualMessage = `AI Gateway authentication failed: Invalid API key. Create a new API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys Alternatively, use an API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys`; Option 1 - API key: Create an API key: https://verc

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/dist-Cw-T1gX6.jsView on unpkg

30Cross-file remote execution chain: dist/dist-Cw-T1gX6.js spawns dist/dist-CHJcZQdS.js; helper contains network access plus dynamic code execution. L30: import { AsyncLocalStorage } from "async_hooks"; L31: import { exec, execFile, spawn } from "child_process"; L32: import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises"; ... L711: } L712: fetch(e, t = {}) { L713: let i = W.hasSubscribers, { status: s = R() ? {} : void 0 } = t; ... L4887: if (hasBuffer && Buffer.isBuffer(text)) text = text.toString(); L4888: if (text && text.charCodeAt(0) === 65279) text = text.slice(1); L4889: const obj = JSON.parse(text, reviver); ... L6592: type: "redacted_reasoning", L6593: value: { data: value.data } L6594: };

dist/sync-BG15Yae1.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/sync-BG15Yae1.js#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged · loading source

dist/dist-DERatX43.cjsView file

30let async_hooks = require("async_hooks"); L31: let child_process = require("child_process"); L32: let fs_promises = require("fs/promises");

High

Child Process

Package source references child process execution.

dist/dist-DERatX43.cjsView on unpkg · L30

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView file

3778if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L3779: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L3780: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView on unpkg · L3778

dist/dist-Cw-T1gX6.jsView file

Findings

1 Critical5 High2 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/dist-Cw-T1gX6.js

HighChild Processdist/dist-DERatX43.cjs

HighShell

HighCredential Redirect Persistencedist/dist-Cw-T1gX6.js

HighCross File Remote Execution Contextdist/dist-Cw-T1gX6.js

HighSemantic Analysis Limiteddist/sync-BG15Yae1.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/schema-Bv9OdW1f-CxTiW8RD.cjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @mastra/server@1.61.0.

See all versions of @mastra/server for other recorded verdicts.

Review the evidence and your use of @mastra/server@1.61.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 06:06:11.369Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code