registry / @mastra/server / 1.71.0
@mastra/server@1.71.0
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe scanner’s credential-redirection claim is not supported by the inspected excerpts: the observed API key path uses a configurable AI Gateway client and its documented environment variable. Command execution and file editing appear in runtime helpers, but no automatic or unauthorized use was established; this review does not resolve every runtime path in the large bundle.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
These helpers are available during runtime; the inspected excerpts do not establish an automatic trigger.
Impact
If invoked, they can run commands or change project files; no unauthorized action was verified.
Mechanism
The helpers can spawn a supplied command and apply supplied project-file edits.
AI rationale
The scanner’s credential-redirection claim is not supported by the inspected excerpts: the observed API key path uses a configurable AI Gateway client and its documented environment variable. Command execution and file editing appear in runtime helpers, but no automatic or unauthorized use was established; this review does not resolve every runtime path in the large bundle.
Evidence
dist/dist-D19QgTH4.js
Network endpoints1
ai-gateway.vercel.sh/v1/ai
Decision evidence
public snapshotAI called this Suspicious at 62.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes its runtime through subpath exports; importing the top-level entry throws an error.
- The bundle contains a configurable AI Gateway client whose default endpoint is ai-gateway.vercel.sh and whose API key comes from an option or AI_GATEWAY_API_KEY.
- The bundle contains agent-builder helpers that can spawn commands and edit project files when invoked.
Evidence against
- package.json has no install lifecycle scripts.
- The inspected credential path supplies a key to the AI Gateway client; no unrelated credential recipient or install-time transfer was established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
6 flagged · loading sourcedist/dist-D19QgTH4.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @mastra/server@1.66.0
matchedIdentity = npm:QG1hc3RyYS9zZXJ2ZXI:1.66.0
similarity = 0.692
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/dist-D19QgTH4.jsView on unpkg30import { AsyncLocalStorage } from "async_hooks";
L31: import { exec, execFile, spawn } from "child_process";
L32: import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises";
High
Child Process
Package source references child process execution.
dist/dist-D19QgTH4.jsView on unpkg · L30•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/dist-D19QgTH4.js:
import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises";
throw new Error("@vercel/oidc is not available in the vendored @internal AI packages. Provide an API key instead.");
if (apiKeyProvided) contextualMessage = `AI Gateway authentication failed: Invalid API key.
Create a new API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys
Alternatively, use an API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys`;
Option 1 - API key:
Create an API key: https://verc
Findings
1 Critical5 High2 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/dist-D19QgTH4.js
HighChild Processdist/dist-D19QgTH4.js
HighShell
HighCredential Redirect Persistencedist/dist-D19QgTH4.js
HighCross File Remote Execution Contextdist/dist-D19QgTH4.js
HighSemantic Analysis Limiteddist/sync-BG15Yae1.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/schema-e0VHpMt0-BS9KHnuT.cjs
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/server@1.71.0.
See all versions of @mastra/server for other recorded verdicts.
- Review the evidence and your use of @mastra/server@1.71.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.