registry / @mastra/server / 1.67.0
@mastra/server@1.67.0
⚠ Under reviewStatic Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
5 flagged · loading sourcedist/dist-DOpm-tIl.jsView file
30import { AsyncLocalStorage } from "async_hooks";
L31: import { exec, execFile, spawn } from "child_process";
L32: import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises";
High
Child Process
Package source references child process execution.
dist/dist-DOpm-tIl.jsView on unpkg · L30•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/dist-DOpm-tIl.js:
import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises";
throw new Error("@vercel/oidc is not available in the vendored @internal AI packages. Provide an API key instead.");
if (apiKeyProvided) contextualMessage = `AI Gateway authentication failed: Invalid API key.
Create a new API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys
Alternatively, use an API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys`;
Option 1 - API key:
Create an API key: https://verc
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/dist-DOpm-tIl.jsView on unpkgFindings
5 High2 Medium6 Low
HighChild Processdist/dist-DOpm-tIl.js
HighShell
HighCredential Redirect Persistencedist/dist-DOpm-tIl.js
HighCross File Remote Execution Contextdist/dist-BKxbtiJd.cjs
HighSemantic Analysis Limiteddist/sync-BG15Yae1.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/schema-D_ikovK6-BzTeMhWf.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/server@1.67.0.
See all versions of @mastra/server for other recorded verdicts.
- Review the evidence and your use of @mastra/server@1.67.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.