@mastra/server@1.66.0
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains a concrete, high-impact agent execution capability, but static inspection found no lifecycle trigger, stealth persistence, credential redirection, or confirmed malicious payload. It should be warned for dangerous capability exposure rather than blocked as malware.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user enables the agent-builder endpoint and submits an authenticated action that invokes these tools.
Impact
A compromised or unsafe agent action could run commands with the server's environment and alter files accessible to that process.
Mechanism
Authenticated agent workflow execution with shell and file-system tools.
AI rationale
The package contains a concrete, high-impact agent execution capability, but static inspection found no lifecycle trigger, stealth persistence, credential redirection, or confirmed malicious payload. It should be warned for dangerous capability exposure rather than blocked as malware.
Evidence
dist/server/handlers/agent-builder.jsdist/dist-4Qm6OSPJ.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- An authenticated agent-builder route lazily loads bundled workflows.
- The loaded workflows expose shell-command execution with caller-provided working directory and environment, inheriting process environment.
- The workflow toolkit can write caller-supplied absolute paths without a project-root restriction.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The agent-builder route explicitly requires authentication.
- No credential redirect, covert exfiltration, or automatic import-time command execution was confirmed.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
6 flagged · loading sourcedist/dist-BmrsK_KX.cjsView file
31let async_hooks = require("async_hooks");
L32: let child_process = require("child_process");
L33: let fs_promises = require("fs/promises");
High
Child Process
Package source references child process execution.
dist/dist-BmrsK_KX.cjsView on unpkg · L31dist/schema-Bv9OdW1f-CxTiW8RD.cjsView file
3778if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch);
L3779: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());
L3780: this.scope.value(validateName, { ref: validate });
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/schema-Bv9OdW1f-CxTiW8RD.cjsView on unpkg · L3778dist/dist-4Qm6OSPJ.jsView file
Findings
1 Critical5 High2 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/dist-4Qm6OSPJ.js
HighChild Processdist/dist-BmrsK_KX.cjs
HighShell
HighCredential Redirect Persistencedist/dist-4Qm6OSPJ.js
HighCross File Remote Execution Contextdist/dist-4Qm6OSPJ.js
HighSemantic Analysis Limiteddist/sync-BG15Yae1.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/schema-Bv9OdW1f-CxTiW8RD.cjs
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/server@1.66.0.
See all versions of @mastra/server for other recorded verdicts.
- Review the evidence and your use of @mastra/server@1.66.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.