@mastra/server@1.62.0

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The flagged gateway and process-execution code resolve to package-aligned AI provider and project-agent functionality, with command availability gated by workspace configuration and an enabled tool flag. The manifest has no install lifecycle hook, and inspection found no confirmed malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Provider token counting or an enabled project agent invoking its command tool.

Impact

No unauthorized credential transfer, persistence, or other attack effect was established.

Mechanism

Gateway authentication uses a dedicated gateway token; other token counting helpers send provider keys to provider APIs. The shell tool runs the requested project command when enabled.

AI rationale

Evidence

package.jsondist/index.jsdist/dist-L0EogwX_.jsdist/dist-Xj9TvH1A.cjsdist/server/handlers/agents.jsdist/server/handlers/agents.cjs

Network endpoints3

ai-gateway.vercel.sh/v1/aiapi.openai.com/v1/responses/input_tokensapi.anthropic.com/v1/messages/count_tokens

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json lists build, generation, check, and test scripts without an install lifecycle hook; the top-level entrypoint throws and directs users to subpath imports.
The flagged bundle’s gateway code uses a dedicated gateway token and targets the Vercel AI gateway; provider token-counting helpers send provider keys to their corresponding provider APIs.
Command execution is part of the project agent tool and is exposed only when a workspace sandbox enables it and the corresponding tool flag is enabled.
The other required bundle paths contain server route handlers, schemas, and runtime utilities consistent with the package’s declared server entrypoints; no independent malicious transfer or persistence behavior was established.

Evidence against

The source includes outbound provider requests and shell execution, but they occur in provider-specific helpers and an enabled project agent tool.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystem

Source & flagged code

6 flagged

dist/dist-Xj9TvH1A.cjsView file

30let async_hooks = require("async_hooks"); L31: let child_process = require("child_process"); L32: let fs_promises = require("fs/promises");

High

Child Process

Package source references child process execution.

dist/dist-Xj9TvH1A.cjsView on unpkg · L30

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView file

Lines 3758-3798javascript

3758 } : { ref: sch.schema }),

3759 validateName,

3760 ValidationError: _ValidationError,

3761 schema: sch.schema,

3762 schemaEnv: sch,

3763 rootId,

3764 baseId: sch.baseId || rootId,

3765 schemaPath: codegen_1.nil,

3766 errSchemaPath: sch.schemaPath || (this.opts.jtd ? "" : "#"),

3767 errorPath: (0, codegen_1._)`""`,

3768 opts: this.opts,

3769 self: this

3770 };

3771 let sourceCode;

3772 try {

3773 this._compilations.add(sch);

3774 (0, validate_1.validateFunctionCode)(schemaCxt);

3775 gen.optimize(this.opts.code.optimize);

3776 const validateCode = gen.toString();

3777 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${validateCode}`;

3778 if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch);

3779 const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());

3780 this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView on unpkg · L3778

3781 validate.errors = null;

3782 validate.schema = sch.schema;

3783 validate.schemaEnv = sch;

3784 if (sch.$async) validate.$async = true;

3785 if (this.opts.code.source === true) validate.source = {

3786 validateName,

3787 validateCode,

3788 scopeValues: gen._values

3789 };

3790 if (this.opts.unevaluated) {

3791 const { props, items } = schemaCxt;

3792 validate.evaluated = {

3793 props: props instanceof codegen_1.Name ? void 0 : props,

3794 items: items instanceof codegen_1.Name ? void 0 : items,

3795 dynamicProps: props instanceof codegen_1.Name,

3796 dynamicItems: items instanceof codegen_1.Name

3797 };

3798 if (validate.source) validate.source.evaluated = (0, codegen_1.stringify)(validate.evaluated);

dist/dist-L0EogwX_.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/server@1.66.0 matchedIdentity = npm:QG1hc3RyYS9zZXJ2ZXI:1.66.0 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-L0EogwX_.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/dist-L0EogwX_.js: import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs"; import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises"; throw new Error("@vercel/oidc is not available in the vendored @internal AI packages. Provide an API key instead."); if (apiKeyProvided) contextualMessage = `AI Gateway authentication failed: Invalid API key. Create a new API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys Alternatively, use an API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys`; Option 1 - API key: Create an API key: https://verc

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/dist-L0EogwX_.jsView on unpkg

30Cross-file remote execution chain: dist/dist-L0EogwX_.js spawns dist/dist-CHJcZQdS.js; helper contains network access plus dynamic code execution. L30: import { AsyncLocalStorage } from "async_hooks"; L31: import { exec, execFile, spawn } from "child_process"; L32: import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises"; ... L711: } L712: fetch(e, t = {}) { L713: let i = W.hasSubscribers, { status: s = R() ? {} : void 0 } = t; ... L4887: if (hasBuffer && Buffer.isBuffer(text)) text = text.toString(); L4888: if (text && text.charCodeAt(0) === 65279) text = text.slice(1); L4889: const obj = JSON.parse(text, reviver); ... L6592: type: "redacted_reasoning", L6593: value: { data: value.data } L6594: };

dist/sync-BG15Yae1.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/sync-BG15Yae1.js#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged · loading source

dist/dist-Xj9TvH1A.cjsView file

30let async_hooks = require("async_hooks"); L31: let child_process = require("child_process"); L32: let fs_promises = require("fs/promises");

High

Child Process

Package source references child process execution.

dist/dist-Xj9TvH1A.cjsView on unpkg · L30

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView file

3778if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L3779: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L3780: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView on unpkg · L3778

dist/dist-L0EogwX_.jsView file

Findings

1 Critical5 High2 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/dist-L0EogwX_.js

HighChild Processdist/dist-Xj9TvH1A.cjs

HighShell

HighCredential Redirect Persistencedist/dist-L0EogwX_.js

HighCross File Remote Execution Contextdist/dist-L0EogwX_.js

HighSemantic Analysis Limiteddist/sync-BG15Yae1.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/schema-Bv9OdW1f-CxTiW8RD.cjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @mastra/server@1.62.0.

See all versions of @mastra/server for other recorded verdicts.

Review the evidence and your use of @mastra/server@1.62.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 05:54:35.770Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code