@mastra/server@1.63.0

⚠ Under review

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The inspected gateway code is consistent with a normal gateway client, and the manifest has no install hook. The bundled runtime is large and the reported credential-redirection behavior was not fully resolved, so this review remains inconclusive.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Unresolved; no malicious activation path was verified.

Impact

No confirmed malicious impact; runtime behavior remains unresolved.

Mechanism

The reviewed gateway client authenticates to its configured gateway endpoint; the inspected excerpts do not show credential redirection or persistence.

AI rationale

Evidence

dist/dist-L0EogwX_.jsdist/dist-Xj9TvH1A.cjspackage.json

Network endpoints1

ai-gateway.vercel.sh/v1/ai

Decision evidence

public snapshot

AI called this Manual Review at 68.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest points to bundled distribution entrypoints and has no install lifecycle hook in its scripts.
The reported gateway code defaults to ai-gateway.vercel.sh and sends gateway authentication to that endpoint.
The flagged shell helper spawns a supplied command and arguments; the inspected excerpt does not establish a malicious caller or activation path.
The reviewed source does not resolve the scanner's credential-redirection claim across the full bundled runtime.

Evidence against

The API key is read from the explicit gateway option or AI_GATEWAY_API_KEY setting, consistent with gateway authentication.
The package's top-level entrypoint throws and directs consumers to specific subpath imports.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinified

Source & flagged code

6 flagged

dist/dist-Xj9TvH1A.cjsView file

30let async_hooks = require("async_hooks"); L31: let child_process = require("child_process"); L32: let fs_promises = require("fs/promises");

High

Child Process

Package source references child process execution.

dist/dist-Xj9TvH1A.cjsView on unpkg · L30

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView file

Lines 3758-3798javascript

3758 } : { ref: sch.schema }),

3759 validateName,

3760 ValidationError: _ValidationError,

3761 schema: sch.schema,

3762 schemaEnv: sch,

3763 rootId,

3764 baseId: sch.baseId || rootId,

3765 schemaPath: codegen_1.nil,

3766 errSchemaPath: sch.schemaPath || (this.opts.jtd ? "" : "#"),

3767 errorPath: (0, codegen_1._)`""`,

3768 opts: this.opts,

3769 self: this

3770 };

3771 let sourceCode;

3772 try {

3773 this._compilations.add(sch);

3774 (0, validate_1.validateFunctionCode)(schemaCxt);

3775 gen.optimize(this.opts.code.optimize);

3776 const validateCode = gen.toString();

3777 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${validateCode}`;

3778 if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch);

3779 const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());

3780 this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView on unpkg · L3778

3781 validate.errors = null;

3782 validate.schema = sch.schema;

3783 validate.schemaEnv = sch;

3784 if (sch.$async) validate.$async = true;

3785 if (this.opts.code.source === true) validate.source = {

3786 validateName,

3787 validateCode,

3788 scopeValues: gen._values

3789 };

3790 if (this.opts.unevaluated) {

3791 const { props, items } = schemaCxt;

3792 validate.evaluated = {

3793 props: props instanceof codegen_1.Name ? void 0 : props,

3794 items: items instanceof codegen_1.Name ? void 0 : items,

3795 dynamicProps: props instanceof codegen_1.Name,

3796 dynamicItems: items instanceof codegen_1.Name

3797 };

3798 if (validate.source) validate.source.evaluated = (0, codegen_1.stringify)(validate.evaluated);

dist/dist-L0EogwX_.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mastra/server@1.66.0 matchedIdentity = npm:QG1hc3RyYS9zZXJ2ZXI:1.66.0 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-L0EogwX_.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/dist-L0EogwX_.js: import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs"; import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises"; throw new Error("@vercel/oidc is not available in the vendored @internal AI packages. Provide an API key instead."); if (apiKeyProvided) contextualMessage = `AI Gateway authentication failed: Invalid API key. Create a new API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys Alternatively, use an API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys`; Option 1 - API key: Create an API key: https://verc

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/dist-L0EogwX_.jsView on unpkg

30Cross-file remote execution chain: dist/dist-L0EogwX_.js spawns dist/dist-CHJcZQdS.js; helper contains network access plus dynamic code execution. L30: import { AsyncLocalStorage } from "async_hooks"; L31: import { exec, execFile, spawn } from "child_process"; L32: import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises"; ... L711: } L712: fetch(e, t = {}) { L713: let i = W.hasSubscribers, { status: s = R() ? {} : void 0 } = t; ... L4887: if (hasBuffer && Buffer.isBuffer(text)) text = text.toString(); L4888: if (text && text.charCodeAt(0) === 65279) text = text.slice(1); L4889: const obj = JSON.parse(text, reviver); ... L6592: type: "redacted_reasoning", L6593: value: { data: value.data } L6594: };

dist/sync-BG15Yae1.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/sync-BG15Yae1.js#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged · loading source

dist/dist-Xj9TvH1A.cjsView file

30let async_hooks = require("async_hooks"); L31: let child_process = require("child_process"); L32: let fs_promises = require("fs/promises");

High

Child Process

Package source references child process execution.

dist/dist-Xj9TvH1A.cjsView on unpkg · L30

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView file

3778if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L3779: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L3780: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schema-Bv9OdW1f-CxTiW8RD.cjsView on unpkg · L3778

dist/dist-L0EogwX_.jsView file

Findings

1 Critical5 High2 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/dist-L0EogwX_.js

HighChild Processdist/dist-Xj9TvH1A.cjs

HighShell

HighCredential Redirect Persistencedist/dist-L0EogwX_.js

HighCross File Remote Execution Contextdist/dist-L0EogwX_.js

HighSemantic Analysis Limiteddist/sync-BG15Yae1.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/schema-Bv9OdW1f-CxTiW8RD.cjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @mastra/server@1.63.0.

See all versions of @mastra/server for other recorded verdicts.

Review the evidence and your use of @mastra/server@1.63.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 05:28:00.880Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code